Executive brief
SourceCodester's Class and Exam Timetabling System is a web-based application used to manage academic schedules and course information. A cross-site scripting (XSS) vulnerability in the /subject1.php file allows attackers to inject malicious scripts that execute in users' browsers without authentication, potentially enabling theft of session tokens, credential theft, or unauthorized actions performed on behalf of victims.
Technical details
This is a reflected cross-site scripting (XSS) vulnerability in the /subject1.php file where the 'subject' parameter is output to the web page without proper encoding or input validation. An attacker can craft a malicious URL containing script payload (e.g., <script>prompt(/xss/);</script>) in the subject parameter, which is then executed in the victim's browser when the page is visited. No authentication is required to exploit this vulnerability. The root cause is insufficient output encoding of user-controlled input. Affected versions include v1.0, and the vulnerability is remotely exploitable via network access.
Affected products
- SourceCodester Class and Exam Timetabling System 1.0
Timeline
- 2026-09-04: disclosed: Vulnerability disclosed on GitHub
- 2026-09-14: advisory: CVE-2026-90615 published on NVD