CVE-2026-4972

Vulnerability

Overview

The Online Reviewer System in PHP version 1.0 contains a stored cross-site scripting (XSS) vulnerability in the file /system/system/students/assessments/databank/btn_functions.php. The application fails to sanitize user input supplied through the description parameter during an action=update request. This input is directly concatenated into a SQL UPDATE statement and stored in the database without any validation or output encoding [1].

Exploitation

An attacker can exploit this vulnerability by sending a crafted HTTP request to the vulnerable endpoint, injecting malicious HTML or JavaScript code into the description field. The attack requires no special privileges beyond the ability to submit the form, and it can be performed remotely. Because the payload is stored in the database, it becomes persistent and will execute automatically in the browser of any user who views the affected question [1].

Impact

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of the victim's session. This can lead to session hijacking, theft of sensitive data, or unauthorized actions within the application. The vulnerability is classified under CWE-79 and has been publicly disclosed with proof-of-concept code [1].

Mitigation

As of the publication date, no official patch has been released by the vendor. The affected version (1.0) is the latest available. Mitigation requires manual input sanitization and output encoding on the server side, or disabling the vulnerable functionality until a fix is applied [1][2].