Executive brief
Clickedu, a school management platform, is vulnerable to a security flaw that allows attackers to run malicious code in a user's web browser. By tricking a student, teacher, or administrator into clicking a specially crafted link, an attacker could steal login sessions or perform unauthorized actions on their behalf. This could lead to the exposure of sensitive educational records or personal data.
Technical details
A reflected Cross-Site Scripting (XSS) vulnerability exists in the Sanoma Clickedu school management platform due to improper neutralization of user-supplied input. The flaw is located in the '/user.php/' endpoint, where input is reflected back to the user without adequate sanitization. An unauthenticated remote attacker can exploit this by crafting a malicious URL and tricking a victim into visiting it. Successful exploitation allows the execution of arbitrary JavaScript in the context of the victim's session, potentially leading to session cookie theft or unauthorized actions. The vulnerability is addressed in version 5.1.
Affected products
- Sanoma Clickedu prior to 5.1
Timeline
- 2026-03-23: advisory: Initial advisory published by INCIBE-CERT
- 2026-03-27: disclosed: CVE published to NVD
- 2026-03-23: patched: Vendor released version 5.1 to address the flaw