Description

A security flaw has been discovered in SourceCodester Class and Exam Timetabling System 1.0. This affects an unknown part of the file /BSHRM1.php. Performing a manipulation of the argument course results in cross site scripting. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-08-17T23:16:52.623Z",
  "pubdate": "2026-08-17T23:16:52.623Z",
  "executiveSummary": "A security flaw has been identified in SourceCodester Class and Exam Timetabling System 1.0, specifically within an undocumented component of the file /BSHRM1.php. The vulnerability manifests as a Cross-Site Scripting (XSS) security issue triggered via the manipulation of the course HTTP parameter. This vulnerability allows remote, unauthenticated attackers to execute arbitrary client-side scripts within the context of a victim's browser session by inducing the application to reflect untrusted user input without adequate output encoding or sanitization. The impact of successful exploitation includes session hijacking, credential theft, defacement of the web interface, and redirection to malicious external domains. Given that an exploit has been publicly disclosed, the risk of active exploitation in the wild is elevated. Threat actors can leverage this vector to target administrative or user sessions remotely, undermining the integrity and confidentiality of interactions with the affected web application. Remediation requires rigorous input validation and context-aware output encoding across all affected parameters and endpoints.",
  "technicalDetails": "The vulnerability resides in SourceCodester Class and Exam Timetabling System 1.0, specifically exposed through the /BSHRM1.php script. The root cause of the flaw is the insecure handling of user-supplied HTTP request data, wherein the course parameter is processed and subsequently reflected back to the client-side user interface without proper input sanitization, filtering, or contextual output encoding.\nCross-Site Scripting (XSS) occurs when an application includes untrusted data in a web page without validating or escaping it. In this scenario, an attacker crafts a malicious Uniform Resource Locator (URL) or submits an HTTP request containing malicious payload data—typically JavaScript or HTML tags—embedded within the course parameter destined for /BSHRM1.php. When the vulnerable application processes this request, it dynamically generates an HTTP response containing the unescaped payload.\nThe attack flow proceeds as follows: First, the remote attacker identifies the injection vector within the /BSHRM1.php endpoint via the course argument. Second, the attacker crafts a malicious payload designed to execute arbitrary JavaScript in the browser of any user who accesses the constructed link. Third, the attacker delivers this payload to the victim via social engineering, phishing, or direct injection methods. Fourth, upon clicking or loading the malicious link, the victim's browser requests the /BSHRM1.php resource with the injected course parameter. Fifth, the server responds by echoing the malicious payload directly into the Document Object Model (DOM) of the rendered page. Finally, the victim's browser parses and executes the embedded script within the security context of the origin site.\nThe exploitation of this vulnerability requires network connectivity to the target web application, as the vector is remotely exploitable. Depending on the application configuration, the attack typically requires no prior authentication or specific privilege levels, allowing unauthenticated remote attackers to execute code in the context of the user visiting the manipulated URL. The post-exploitation impact includes the potential extraction of session cookies, manipulation of DOM elements, execution of actions on behalf of the authenticated user, and continuous surveillance of the user's interaction with the affected timetabling system."
}