Executive brief
SourceCodester Smart Attendance System with QR Code Scanner is a web application for managing student attendance. An attacker can inject malicious code through the student sign-up form's full name field, which is reflected back to users without sanitization. This could allow attackers to steal session credentials, redirect users to phishing sites, or perform actions on behalf of affected users.
Technical details
The vulnerability is a cross-site scripting (XSS) flaw in the student_signup.php file's self-registration component. The full_name parameter is prepended to output without proper HTML encoding or validation, allowing injection of arbitrary JavaScript. Remote exploitation requires user interaction (victim accessing the malicious link) but no authentication.
Affected products
- SourceCodester Smart Attendance System with QR Code Scanner 1.0
Timeline
- 2026-09-23: disclosed