Description
A vulnerability was found in lahirudanushka School Management System 1.0.0/1.0.1 and classified as problematic. This issue affects some unknown processing of the file /subject.php of the component Subject Page. The manipulation of the argument Subject Title/Sybillus Details leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-269807.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| lahirudanushka | School Management System | 1.0.0, 1.0.1 | — |
References
- VDB-269807 | lahirudanushka School Management System Subject Page subject.php cross site scripting vdb-entry technical-description
- VDB-269807 | CTI Indicators (IOB, IOC, TTP, IOA) signature permissions-required
- Submit #364874 | lahirudanushka School-Management-System---PHP-MySQL Public 1.0.1 Cross Site Scripting third-party-advisory
- https://secretive-agate-23c.notion.site/School-Management-System-PHP-MySQL-stored-1-0-1-XSS-50088f0ed9e94efda9c57772ce192980 related
- https://secretive-agate-23c.notion.site/School-Management-System-PHP-MySQL-stored-1-0-1-Stored-XSS-41c9f85f307441c5885fb0df3d3fcc08 exploit