Description

A vulnerability was found in SourceCodester Syllabus-Aligned Learning Management & Examination System 1.0. The affected element is an unknown function of the file manage_subjects.php. The manipulation of the argument msg/title/content results in cross site scripting. The attack may be performed from remote. The exploit has been made public and could be used.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-09-07T07:16:47.793Z",
  "pubdate": "2026-09-07T07:16:47.793Z",
  "executiveSummary": "A reflected cross-site scripting (XSS) vulnerability exists in version 1.0 of the SourceCodester Syllabus-Aligned Learning Management & Examination System.\nThe vulnerability resides within the manage_subjects.php file, where improper validation of user-supplied input allows for the injection of arbitrary malicious scripts.\nThe flaw can be exploited remotely by an unauthenticated or authenticated attacker, depending on the application's access control configuration, by manipulating the msg, title, or content arguments.\nSuccessful exploitation enables the execution of malicious JavaScript in the context of the victim's browser session.\nPotential impacts include the theft of sensitive session cookies, unauthorized actions performed on behalf of the user, redirection to malicious domains, and defacement of the application interface.\nGiven that exploit code has been publicly disclosed, the risk of active exploitation is significant, requiring immediate attention to secure the input handling mechanisms.",
  "technicalDetails": "The vulnerability is identified as a Reflected Cross-Site Scripting (XSS) issue originating from insufficient input sanitization and output encoding within the manage_subjects.php file.\nThe application processes user-controlled input provided via the 'msg', 'title', or 'content' parameters. These arguments are processed by the server-side script and subsequently reflected in the HTTP response body without adequate neutralization of HTML special characters or script tags.\nThe attack flow involves an attacker crafting a malicious URL containing a JavaScript payload within one of the vulnerable parameters. When a victim accesses this crafted link, the server processes the request and embeds the malicious script directly into the HTML document returned to the victim's browser.\nUpon receipt of the manipulated response, the victim's browser interprets the injected script as legitimate code originating from the trusted domain. This execution bypasses Same-Origin Policy (SOP) protections, allowing the attacker to access document contents, session tokens stored in cookies, or perform unauthorized state-changing operations via the user's active session.\nThe root cause is the lack of context-aware output encoding (e.g., HTML entity encoding) when rendering user input back to the end-user. Because the application fails to distinguish between data and executable code, any arbitrary script tags provided in the input parameters are executed upon page load.\nThe exploit is performed remotely and does not necessarily require deep system access, relying instead on social engineering techniques to induce a victim to visit the malicious URL. Once triggered, the payload executes immediately within the user's session context, potentially leading to full session hijacking or further client-side attacks.\nThe vulnerability affects SourceCodester Syllabus-Aligned Learning Management & Examination System version 1.0. The susceptibility of specific functions within manage_subjects.php suggests a systemic failure in input handling libraries or the absence of a global filtering mechanism within the application's framework."
}