Description

A vulnerability was identified in SourceCodester Class and Exam Timetabling System 1.0. Affected by this issue is some unknown functionality of the file /BSCE2.php. Such manipulation of the argument course leads to cross site scripting. The attack may be launched remotely. The exploit is publicly available and might be used.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-08-17T22:17:26.880Z",
  "pubdate": "2026-08-17T22:17:26.880Z",
  "executiveSummary": "An identified vulnerability exists within the SourceCodester Class and Exam Timetabling System 1.0, specifically residing in the /BSCE2.php file. The vulnerability is classified as a Cross-Site Scripting (XSS) flaw, stemming from the improper handling of user-supplied input passed via the course parameter.\nThe primary impact of this security defect includes the execution of malicious client-side scripts, such as JavaScript, within the context of a victim's browser session. This can lead to session hijacking, credential theft, or unauthorized actions performed on behalf of the authenticated user.\nThe affected product is SourceCodester Class and Exam Timetabling System version 1.0. The risk implications are moderate to high depending on the privileges of the targeted user interacting with the application. The attack vector is network-based, allowing remote threat actors to launch exploit payloads without requiring prior physical access.\nPublic availability of exploit methodologies increases the likelihood of active exploitation. Successful exploitation requires an attacker to successfully manipulate the vulnerable course parameter within the targeted file, often via crafted URLs delivered to victims.",
  "technicalDetails": "The vulnerability is rooted in the lack of adequate input sanitization and output encoding mechanisms within the application source code handling the /BSCE2.php endpoint. Specifically, the parameter course fails to undergo proper validation or contextual escaping before being reflected back to the user within the HyperText Markup Language (HTML) response generated by the server.\nThis creates a Reflected Cross-Site Scripting (XSS) condition. The vulnerable component is the script processing the course argument inside /BSCE2.0php. Because the application blindly trusts or insufficiently filters the input, an attacker can inject arbitrary script tags, event handlers, or other executable markup into the HTTP request.\nThe attack flow proceeds as follows: First, the remote attacker crafts a malicious Uniform Resource Locator (URL) targeting the /BSCE2.php endpoint, substituting standard values within the course parameter with malicious JavaScript payloads. Second, the attacker induces a victim—such as an authenticated administrator or standard user—to click or otherwise navigate to the crafted URL via social engineering or other delivery mechanisms. Third, the victim's browser sends the HTTP request containing the malicious payload to the server hosting SourceCodester Class and Exam Timetabling System 1.0. Fourth, the server processes the request, embeds the unsanitized value of the course parameter into the resulting HTTP response body, and transmits it back to the victim's browser. Fifth, the victim's browser parses the HTML response and executes the injected script within the security context of the vulnerable application, assuming the code originates from a trusted source.\nNetwork exposure is remote, as the application is typically accessible over HTTP or HTTPS via standard web interfaces. Authentication and privilege requirements depend on whether the endpoint /BSCE2.php is behind an access control check; however, if accessible unauthenticated, unprivileged attackers can execute the exploit against any targeted user.\nPost-exploitation impact includes the potential theft of session cookies, manipulation of the Document Object Model (DOM), redirection to malicious external sites, keylogging, or performance of unauthorized administrative actions if the victim holds elevated privileges within the Class and Exam Timetabling System."
}