SourceCodester Class and Exam Timetabling System Cross-Site Scripting Vulnerability

A cross-site scripting (XSS) vulnerability has been identified in SourceCodester Class and Exam Timetabling System version 1.0. The issue arises in the file '/CYS.php', where the 'course' parameter is not properly validated or encoded, allowing attackers to inject malicious scripts. This vulnerability can be exploited remotely, with the injected scripts executed in the context of the user's browser.

Impact

Exploitation of this vulnerability allows for cross-site scripting, where an attacker can inject and execute scripts in the victim's browser. This could lead to the theft of cookies, session tokens, or other sensitive information, as well as performing actions on behalf of the victim or redirecting them to malicious websites.

Reproduction

To reproduce this vulnerability, access the '/CYS.php' file as an admin. Edit the 'course' parameter by inserting a script payload, such as a prompt script. Once the payload is injected, the script will execute in the context of the user's browser, demonstrating the cross-site scripting vulnerability.

Remediation

To address this vulnerability, implement output encoding for user inputs when displaying them on the web page. Validate and filter input data to reject or escape potentially harmful content, such as script tags. Consider using a Content Security Policy to restrict the execution of scripts. For sensitive cookies, set the HttpOnly and Secure flags. Regular security audits can also help identify and fix such vulnerabilities.