Description

A vulnerability has been found in ningzichun student-management-system up to 98760f5711cf6dc8b4adca53a9e207ca49b02ebf. Affected by this issue is the function echo of the file admin/fun/addLog.php. The manipulation of the argument reason/detail leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through an issue report but has not responded yet.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-09-25T03:16:59.087Z",
  "pubdate": "2026-09-25T03:16:59.087Z",
  "executiveSummary": "A cross-site scripting (XSS) vulnerability exists in the ningzichun student-management-system up to commit 98760f5711cf6dc8b4adca53a9e207ca49b02ebf.\nThe vulnerability resides in the administrative logging functionality, specifically within the echo function of admin/fun/addLog.php.\nThe flaw stems from improper neutralization of user-supplied input provided via the 'reason' or 'detail' arguments before rendering them in the web interface.\nAn unauthenticated or authenticated attacker can leverage this weakness to execute arbitrary JavaScript in the context of an administrator's browser session.\nSuccessful exploitation could lead to session hijacking, unauthorized administrative actions, or defacement of the management console.\nAs the exploit code is publicly available, the risk to instances of this software is high. There is currently no official patch available from the maintainers.",
  "technicalDetails": "The vulnerability is a classic reflected cross-site scripting (XSS) flaw located in the admin/fun/addLog.php file of the ningzichun student-management-system.\nThe root cause is the insecure handling of the 'reason' and 'detail' parameters within the PHP echo function. The application fails to perform adequate input validation or context-aware output encoding on these arguments before reflecting them directly into the HTTP response body.\nThe attack flow begins when an attacker crafts a malicious URL or request containing a payload designed to break out of the intended HTML context. For instance, an attacker could provide an argument such as 'reason=<script>alert(document.cookie)</script>'. When the server-side script processes this input and returns it to the client, the browser interprets the injected script as valid code belonging to the application's origin.\nBecause the vulnerable component is located within an administrative file (admin/fun/addLog.php), the execution of the payload occurs within the security context of the administrative session. If an administrator visits a link containing the malicious payload, the attacker-supplied script executes with the privileges of that administrator.\nThis vulnerability is remotely exploitable and does not inherently require prior authentication if the vulnerable endpoint is accessible without strict access control enforcement. The lack of proper sanitization means that any character sequence that can influence the DOM, such as HTML tags or event handlers (e.g., onerror, onload), can be injected to facilitate the execution of arbitrary JavaScript.\nThe potential impact includes, but is not limited to, theft of session cookies (if HttpOnly flags are not set on cookies), performing unauthorized administrative actions on behalf of the victim, unauthorized redirection to external malicious sites, or the exfiltration of sensitive system logs and data displayed on the dashboard.\nSince the project has not responded to reported issues, the vulnerability remains active in all versions up to commit 98760f5711cf6dc8b4adca53a9e207ca49b02ebf."
}