Cyber-III Student-Management System Cross-Site Scripting Vulnerability in Add Notice PHP File
Vulnerability
A reflected cross-site scripting vulnerability has been identified in the Cyber-III Student-Management System, specifically in versions prior to 1a938fa61e9f735078e9b291d2e6215b4942af3f. The issue arises in the file '/admin/Add notice/add notice.php', where the unsanitized '$_SERVER["PHP_SELF"]' variable is used in the 'action' attribute of two forms. This allows attackers to inject arbitrary JavaScript code via a crafted URL. The vulnerability can be exploited remotely, and an exploit is publicly available.
Impact
Exploitation of this vulnerability allows for reflected cross-site scripting, where injected scripts are executed in the context of the user's browser.
Reproduction
To reproduce this vulnerability, log into the admin panel with the username 'admin' and password 'admin123'. Once logged in, navigate to the 'Add notice' page. The vulnerability can be exploited by using a crafted URL that includes a script injection, such as a JavaScript alert. When the URL is accessed, the injected script will execute in the browser.
Remediation
No specific remediation is known for this vulnerability. However, it is recommended to sanitize user input before outputting it in a way that can be controlled by users.
Vulnerability Rating
Our algorithm analyzes dozens of metrics to generate these 8 key vulnerability categories, which are then combined to calculate the overall risk score.