Executive Summary

The vulnerability in CVE-2026-5671 affects the /admin/class schedule/delete_batch.php endpoint of the Cyber-III Student-Management-System. It involves two main security issues: unauthorized access and reflected cross-site scripting (XSS).

First, the endpoint lacks proper administrator permission checks, allowing any user, including unauthenticated ones, to access and execute batch deletion operations that should be restricted to administrators.

Second, the 'batch' parameter from POST requests is directly embedded into the HTML response without sanitization or escaping. This allows attackers to inject malicious JavaScript code that is reflected back and executed in the victim's browser.

An attacker can send a specially crafted POST request with a script payload in the 'batch' parameter, causing the injected script to execute in the victim's browser, confirming both unauthorized access and reflected XSS.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can impact you by allowing unauthorized users to perform administrative batch deletion operations without proper permissions, potentially leading to data loss or disruption of service.

Additionally, the reflected cross-site scripting (XSS) vulnerability can be exploited to execute malicious scripts in the browsers of users who access the affected endpoint. This can lead to session hijacking, theft of sensitive information, or other malicious actions performed on behalf of the victim.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by sending a crafted POST request to the endpoint /admin/class%20schedule/delete_batch.php with a script payload in the batch parameter and observing if the script is reflected in the response.

• Use a command like: curl -X POST -d "batch=<script>alert('XSS_POC')</script>" http://<target-host>/admin/class%20schedule/delete_batch.php -H "Content-Type: application/x-www-form-urlencoded"
• If the response HTML contains the injected script (e.g., Batch '<script>alert('XSS_POC')</script>' schedules deleted successfully), it confirms the presence of the reflected XSS vulnerability.
• Also check if the endpoint is accessible without authentication, indicating unauthorized access vulnerability.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include implementing strict authentication and authorization checks to ensure only administrators can access and perform batch deletions.

• Verify session data or valid tokens before processing requests to the /admin/class schedule/delete_batch.php endpoint.
• Sanitize all user-supplied input, especially the batch parameter, before including it in HTML output by applying functions like htmlspecialchars() to prevent script injection and reflected XSS.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability in CVE-2026-5671 allows unauthorized access to an administrative endpoint and enables reflected cross-site scripting (XSS) attacks. This can lead to unauthorized manipulation of data and execution of malicious scripts in users' browsers.

Such security weaknesses can negatively impact compliance with common standards and regulations like GDPR and HIPAA, which require protection of personal data and secure access controls. Unauthorized access and XSS vulnerabilities increase the risk of data breaches and unauthorized data exposure, potentially violating these regulations.

Therefore, failure to implement proper authentication, authorization, and input sanitization as recommended can result in non-compliance with these standards.

Useful 0 Not Useful 0