Executive brief
SourceCodester's Class and Exam Timetabling System is a web application used to manage class schedules and exam timetables. The system contains a cross-site scripting (XSS) vulnerability in the BSCE2.php file that allows attackers to inject malicious scripts through the course parameter. Exploitation could enable attackers to steal student or administrator credentials, hijack sessions, deface pages, or redirect users to malicious sites without requiring any authentication.
Technical details
This is a reflected/stored cross-site scripting (XSS) vulnerability in the /BSCE2.php file of Class and Exam Timetabling System version 1.0. The vulnerable component fails to properly encode or filter the 'course' parameter before outputting it to the web page, allowing attackers to inject arbitrary JavaScript code. The attack is network-accessible and requires no authentication; an attacker can craft a malicious URL or inject the payload through a form parameter and any user accessing the page would execute the injected script in their browser. The impact includes session hijacking, credential theft, unauthorized actions, and malware distribution. No patch information is currently available from the vendor.
Affected products
- SourceCodester Class and Exam Timetabling System 1.0
Timeline
- 2026-07-01: disclosed: Vulnerability reported on GitHub
- 2026-08-17: advisory: CVE-2026-75077 published