Executive brief
SourceCodester's Class and Exam Timetabling System is a PHP web application used for managing course schedules and exam timetables in educational institutions. The application contains a cross-site scripting (XSS) vulnerability in the BSIS1.php file that allows attackers to inject malicious scripts through the course parameter without authentication, potentially enabling theft of user session data, account compromise, or malware distribution.
Technical details
A reflected cross-site scripting (XSS) vulnerability exists in the BSIS1.php file of SourceCodester's Class and Exam Timetabling System version 1.0. The vulnerable component fails to properly encode or filter user input from the 'course' parameter before reflecting it back to the web page. An attacker can craft a malicious URL containing JavaScript code (e.g., <script>prompt(/xss/);</script>) in the course parameter and trick a user into clicking the link. The injected script executes in the victim's browser with their session context, allowing theft of session cookies, credentials, or performance of actions on behalf of the user. No authentication is required to exploit this vulnerability. The vendor has not released a patch as of the advisory publication date.
Affected products
- SourceCodester Class and Exam Timetabling System 1.0
Timeline
- 2026-07-06: disclosed: Vulnerability reported on GitHub
- 2026-08-23: advisory: NVD entry published for CVE-2026-78054