Executive brief
SourceCodester Class and Exam Timetabling System is a web-based scheduling application used by educational institutions to manage course and exam timetables. The application contains a cross-site scripting (XSS) vulnerability in the course parameter that allows unauthenticated attackers to inject malicious scripts. Successful exploitation could enable attackers to steal student or staff session data, deface the timetable, or redirect users to phishing sites.
Technical details
This is a reflected or stored cross-site scripting (XSS) vulnerability in the /BSIT2.php file, triggered via the 'course' parameter. The root cause is insufficient input validation and output encoding—user-supplied input is rendered directly into the HTML response without sanitization or proper encoding. No authentication is required; attackers can craft malicious URLs or inject payloads through the course parameter (e.g., <script>prompt(/xss/);</script>) to execute arbitrary JavaScript in victims' browsers. Successful exploitation allows theft of session cookies, credential harvesting, and account hijacking. No patch information is currently available; remediation requires output encoding, input filtering, and implementation of Content Security Policy (CSP).
Affected products
- SourceCodester Class and Exam Timetabling System 1.0
Timeline
- 2026-07-06: disclosed
- 2026-08-23: advisory