CVE-2026-10228

Vulnerability

A stored cross-site scripting (XSS) vulnerability exists in the admission_form_check.php file of the raisulislamg4/student_management_system_by_php project up to commit 310d950e09013d5133c6b9210aff9444382d16d1. The application directly inserts user-supplied input from the Message POST parameter into the database without sanitization. Later, the admissions.php page renders the stored message inside an HTML `` element without output encoding, leading to XSS. The project uses a rolling release model, so no specific version number is available [1][2].

Exploitation

An attacker can exploit this by submitting an admission form with a malicious JavaScript payload in the message field. For example, sending a POST request to /admission_form_check.php with message= stores the payload. When an administrator views the admissions list at admissions.php, the script executes in the admin's browser. No authentication is required to submit the form, and the attack can be performed remotely [1].

Impact

Successful exploitation allows arbitrary JavaScript execution in the context of the administrator's session. This can lead to session hijacking, theft of admin cookies, account takeover, and unauthorized administrative actions such as creating or deleting users, modifying records, and full system compromise [1].

Mitigation

As of the publication date (2026-06-01), no fix has been released. The project maintainer was informed via an issue report but has not responded [1]. Mitigation requires manually sanitizing the Message input (e.g., using htmlspecialchars() in PHP) and properly encoding output in admissions.php. Since the project follows a rolling release, users should monitor the repository for updates [2].