yashpokharna2555 StudentManagementSystem student.php cross site scripting

Vulnerability

A stored cross-site scripting (XSS) vulnerability exists in the StudentManagementSystem project by yashpokharna2555 [1]. The flaw resides in the file /student.php, where the FIRST_NAME parameter is retrieved from the database and directly output into an HTML ` element without any sanitization or encoding [2]. The project uses continuous delivery with rolling releases, so no specific affected version is available; the commit cb2f558ddf8d19396de0f92abf2d224d46a0a203` is known to be vulnerable [1].

Exploitation

An attacker must first insert a malicious JavaScript payload into the FIRST_NAME field, which can be achieved through a separate unauthorized data insertion vulnerability (also reported in the same issue) [2]. After the payload is stored, any authenticated user who visits /student.php will trigger the script execution in their browser. The proof-of-concept uses `` as the payload [2]. No special network position is required beyond remote access to the application.

Impact

Successful exploitation allows arbitrary JavaScript execution in the context of the victim's session. This can lead to theft of session cookies, enabling full account takeover, and if an administrator triggers the payload, it may result in privilege escalation or back-end data manipulation [2].

Mitigation

No official fix has been released; the project maintainer was informed via an issue report but has not responded [2]. As of the publication date, no patched version exists. Users should sanitize all user-supplied output, especially the FIRST_NAME field, by encoding HTML entities before rendering. Until a fix is available, restricting access to the application or implementing a web application firewall (WAF) rule to block script payloads may reduce risk.