Huang-yk Student-Manage Cross-Site Scripting Vulnerability in Edit Student Information Component

A cross-site scripting (XSS) vulnerability has been identified in Huang-yk Student-Manage version 1.0. The issue arises in the 'Edit a Student Information' page, specifically within the 'Class' argument. The vulnerability allows for remote exploitation, requiring authenticated user interaction. The flaw has been publicly disclosed, with available technical details and a proof-of-concept exploit.

Impact

Exploitation of this vulnerability allows for cross-site scripting, where an attacker can inject malicious scripts that are executed in the context of the user's browser.

Reproduction

To reproduce this vulnerability, navigate to the 'Edit a Student Information' page within the application. Insert a payload into the 'Class' argument, which will trigger the cross-site scripting vulnerability when the information is saved and the page is revisited.