Executive Summary

CVE-2026-5644 is a reflected Cross-Site Scripting (XSS) vulnerability found in the Cyber-III Student-Management-System, specifically in the file /admin/Add notice/batch-notice.php. The vulnerability occurs because the PHP script uses the unsanitized $_SERVER['PHP_SELF'] variable directly as the form's action attribute. This allows an attacker to craft a malicious URL that injects arbitrary JavaScript code, which is then executed by the victim's browser.

An attacker can exploit this by logging into the admin panel and accessing a specially crafted URL that includes malicious script code. This injected code can execute in the context of the admin's browser session.

The recommended fix is to avoid outputting user-controllable input directly in the form action attribute. Instead, use a hardcoded relative URL or properly sanitize the output using functions like htmlspecialchars to encode special characters and prevent script execution.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow attackers to execute arbitrary JavaScript code in the context of an authenticated admin user's browser session.

• Steal admin session cookies, potentially allowing the attacker to hijack the admin session.
• Perform phishing attacks by injecting malicious scripts that mimic legitimate admin interface elements.
• Execute other malicious payloads that could compromise the integrity and security of the Student Management System.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by attempting to reproduce the reflected Cross-Site Scripting (XSS) attack on the affected URL. Specifically, an attacker or tester can log into the admin panel with valid credentials and access a specially crafted URL that injects JavaScript code via the PHP_SELF variable.

• Log in to the admin panel using credentials such as username: admin and password: admin123.
• Access a URL similar to: http://127.0.0.1:3000/admin/Add%20notice/batch-notice.php/%22%3E%3Cscript%3Ealert('XSS_POC')%3C/script%3E

If the alert box with 'XSS_POC' appears, the vulnerability is present. This confirms that the PHP_SELF variable is unsafely used and allows script injection.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability immediately, avoid directly outputting the user-controllable $_SERVER['PHP_SELF'] variable in the form action attribute.

• Replace the vulnerable PHP code `<?php echo $_SERVER['PHP_SELF']; ?>` with a hardcoded relative URL such as an empty string `""` or the specific filename like `"batch-notice.php"`.
• If dynamic values are necessary, properly sanitize the output using PHP's htmlspecialchars function: `<?php echo htmlspecialchars($_SERVER['PHP_SELF'], ENT_QUOTES, 'UTF-8'); ?>`.

These changes prevent execution of injected scripts by encoding special characters, thereby mitigating the reflected XSS vulnerability.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability is a reflected Cross-Site Scripting (XSS) flaw in the Cyber-III Student-Management-System that allows execution of arbitrary JavaScript code in the context of the admin panel.

Such XSS vulnerabilities can lead to session hijacking, theft of sensitive information, or phishing attacks, which may result in unauthorized access to personal or sensitive data.

This unauthorized access or exposure of sensitive data could potentially violate data protection regulations such as GDPR or HIPAA, which require safeguarding personal and health information against unauthorized access and ensuring data integrity and confidentiality.

Therefore, the presence of this vulnerability may negatively impact compliance with these standards by increasing the risk of data breaches or unauthorized data manipulation.

Useful 0 Not Useful 0