Executive brief
A security vulnerability exists in the Coaching Management System, a software platform used to manage educational coaching centers. An attacker can submit a malicious complaint that, when viewed by a teacher or administrator, allows the attacker to hijack their session or perform actions on their behalf. This could lead to unauthorized access to student records or administrative control of the system.
Technical details
A stored cross-site scripting (XSS) vulnerability exists in code-projects Coaching Management System 1.0 within the Complaint Form Page. The issue stems from improper neutralization of user-supplied input in the 'Complaint' argument within /cims/modules/student/complaint.php. A low-privileged student user can submit a complaint containing malicious JavaScript; when an administrator or teacher views this complaint via /modules/admin/incomingcomplaint.php, the script executes in their session. This can be leveraged to steal session cookies and achieve account takeover or privilege escalation. A public exploit (PoC) has been disclosed.
Affected products
- code-projects Coaching Management System 1.0
Timeline
- 2026-04-28: disclosed: Vulnerability disclosed and PoC published on GitHub.
- 2026-04-28: advisory