Description

A security vulnerability has been detected in SourceCodester Class and Exam Timetabling System 1.0. This affects an unknown part of the file /subject1.php. Such manipulation of the argument subject leads to cross site scripting. The attack can be executed remotely. The exploit has been disclosed publicly and may be used.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-09-14T02:17:16.030Z",
  "pubdate": "2026-09-14T02:17:16.030Z",
  "executiveSummary": "A Cross-Site Scripting (XSS) vulnerability has been identified in the Class and Exam Timetabling System version 1.0. The vulnerability exists within the /subject1.php file due to improper validation of the subject argument.\nThis flaw allows remote, unauthenticated attackers to inject malicious JavaScript into the application's response, which is then executed within the context of the victim's browser session.\nSuccessful exploitation can result in session hijacking, unauthorized actions performed on behalf of the user, and the theft of sensitive session tokens or credentials.\nThe vulnerability is publicly disclosed, increasing the risk of active exploitation by threat actors targeting this specific product version. Organizations utilizing this system are at significant risk if the input handling mechanism is not secured.",
  "technicalDetails": "The vulnerability is a classic Reflected Cross-Site Scripting (XSS) flaw located in the /subject1.php script. The root cause of this vulnerability is the application's failure to adequately sanitize or encode user-supplied data passed via the subject URL parameter before reflecting it back to the user's browser in the HTTP response.\nThe exploitation flow begins with an attacker crafting a malicious URI containing a JavaScript payload within the subject parameter. For instance, an attacker may append a string such as <script>alert(document.cookie)</script> to the query string of the /subject1.php endpoint.\nWhen an unsuspecting, authenticated, or unauthenticated user clicks on this specially crafted link, the server processes the request and embeds the unvalidated, malicious input directly into the HTML body or attributes of the generated page. The victim's web browser, perceiving the injected script as a legitimate part of the document, parses and executes the code within the origin context of the application.\nBecause the payload executes within the security context of the user's session, the attacker can access sensitive information such as document cookies, local storage, or perform unauthorized state-changing operations on behalf of the user. In scenarios where an administrator interacts with the malicious link, the attacker could potentially gain full control over the administrative interface, leading to a complete compromise of the system's data and functionality.\nThe /subject1.php component does not employ modern defense-in-depth mechanisms such as Content Security Policy (CSP) headers or rigorous input validation routines, which facilitates the arbitrary execution of client-side scripts. This vulnerability is accessible over the network without requiring prior authentication, making it a highly accessible vector for remote attackers."
}