SourceCodester Class and Exam Timetabling System Cross-Site Scripting Vulnerability

A cross-site scripting (XSS) vulnerability has been identified in SourceCodester Class and Exam Timetabling System version 1.0. The issue arises in the file '/forCYS.php', where the 'course' parameter is not properly validated or encoded before being output to the web page. This flaw allows remote attackers to inject malicious scripts that could be executed in the context of the user's browser, potentially leading to the theft of cookies, session tokens, or other sensitive information.

Impact

Exploitation of this vulnerability allows for cross-site scripting, where injected scripts are executed in the context of the user's browser.

Reproduction

To reproduce this vulnerability, access the '/forCYS.php' file as an admin. Edit the 'course' parameter by inserting a script payload, such as a prompt script. Once the payload is submitted, the injected script will execute, demonstrating the cross-site scripting vulnerability.

Remediation

To address this vulnerability, implement output encoding for user inputs before displaying them on the web page. Validate and filter input data to reject or escape potentially malicious content. Consider using a Content Security Policy to restrict script execution sources, and set secure and HttpOnly flags for sensitive cookies. Regular security audits can help identify and fix such vulnerabilities.