QDOCS Smart School Management System Cross-Site Scripting Vulnerability in Admission Enquiry Module

A cross-site scripting (XSS) vulnerability has been identified in QDOCS Smart School Management System versions up to 7.2. The issue resides in the Admission Enquiry Module, specifically within an unknown function of the file '/admin/enquiry'. The vulnerability allows remote attackers to inject malicious scripts by manipulating the 'Note' argument, which are then executed when the affected record is viewed by users with higher privileges.

Impact

Exploitation of this vulnerability allows for stored cross-site scripting, where injected scripts are executed in the context of the user viewing the record. This could lead to client-side code execution, information disclosure, and unauthorized actions performed with the victim's privileges.