Smart School Stored Cross-Site Scripting Vulnerability

A stored cross-site scripting vulnerability has been identified in Smart School version 7.0. This issue arises from inadequate validation of user input in POST requests to the '/online_admission' endpoint, particularly affecting the 'firstname', 'lastname', 'guardian_name', and potentially other parameters. Exploitation of this vulnerability could enable a remote user to send a specially crafted request to an authenticated user, potentially allowing the attacker to steal the user's session cookie details.

Impact

Exploitation of this vulnerability allows for stored cross-site scripting, where injected scripts are executed in the context of the user.