Executive brief
PHPGurukul Hostel Management System is a web application used to manage hostel operations, including student records, complaints, and room assignments. The system contains a stored cross-site scripting vulnerability in multiple administrative pages that allows authenticated students to inject malicious scripts into the database through form submissions. When administrators view these affected records, the injected scripts execute in their browser, potentially enabling attackers to steal administrative credentials, hijack sessions, or perform unauthorized actions with admin privileges.
Technical details
The vulnerability is a stored cross-site scripting (XSS) flaw in multiple administrative view files including /admin/manage-students.php, /admin/student-details.php, /admin/complaint-details.php, /admin/feedback-details.php, /admin/feedbacks.php, /admin/manage-courses.php, and /admin/manage-rooms.php. The root cause is that database-backed values (student names, complaint details, feedback values, course names, and room values) are rendered directly into HTML using raw PHP echo statements without output encoding. An authenticated student can submit crafted values through registration, complaint submission, or feedback forms; these payloads are stored in the database and executed when an administrator views the affected record. The attack requires login (PR:L) and user interaction (UI:R, the admin must view the page), but impacts confidentiality and integrity with cross-origin scope. Remediation involves applying HTML entity encoding (htmlentities with ENT_QUOTES) to all database-backed output in administrative views and implementing Content Security Policy headers.
Affected products
- PHPGurukul Hostel Management System 3.0
Timeline
- 2026-08-13: disclosed: Issue opened on GitHub
- 2026-09-15: advisory: Published on NVD