Executive brief
The Student Grades Management System, a web application used for tracking academic performance, contains a security flaw that allows for cross-site scripting (XSS). An attacker can inject malicious scripts into the 'Remarks' field, which could then execute in the browser of other users, such as teachers or administrators. This could lead to unauthorized actions being performed in the context of the victim's session or the defacement of student records.
Technical details
A cross-site scripting (XSS) vulnerability exists in SourceCodester Student Grades Management System 1.0. The flaw is located within the 'students.php' file due to insufficient sanitization of the 'Remarks' input argument. A remote attacker with low privileges can exploit this by submitting a specially crafted string containing malicious JavaScript. When an authorized user views the affected student record, the script executes in their browser context. This is a stored XSS vulnerability that can lead to session hijacking or unauthorized manipulation of the web interface. Public exploit code is reportedly available.
Affected products
- SourceCodester Student Grades Management System 1.0
Timeline
- 2026-05-25: disclosed: Initial disclosure and NVD publication