Compliance Impact

The vulnerability allows remote attackers to inject malicious scripts via the student name parameter, leading to stored cross-site scripting (XSS). This can result in session hijacking and account takeover, including administrator accounts.

Such unauthorized access and potential data manipulation or exposure could lead to violations of data protection regulations like GDPR or HIPAA, which require safeguarding personal data and preventing unauthorized access.

Because the vulnerability enables attackers to compromise user sessions and potentially access sensitive student information, it undermines the confidentiality and integrity requirements mandated by these standards.

Useful 0 Not Useful 0

Executive Summary

CVE-2026-9518 is a Stored Cross-Site Scripting (XSS) vulnerability in the CodeIgniter Student Management System, specifically in the addStudent function of the Students Controller within the view_students.php file.

The vulnerability occurs because the system does not sanitize or filter the user-supplied input for the student name before storing it in the database. Later, when the student names are displayed on the student listing page, the malicious JavaScript code injected via the name parameter is executed in the browsers of users viewing that page.

This flaw can be exploited remotely without authentication due to broken access control, allowing an attacker to inject malicious scripts by sending crafted requests.

Useful 0 Not Useful 0

Impact Analysis

The impact of this vulnerability includes the potential for session hijacking and account takeover if an administrator's session is compromised.

An attacker can also deface the website or redirect users to malicious sites by injecting harmful scripts.

Since the vulnerability can be exploited remotely without credentials, it poses a significant risk of drive-by attacks affecting any user who visits the compromised student listing page.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by checking for the presence of unsanitized input in the student name field that leads to stored cross-site scripting (XSS) in the CodeIgniter Student Management System. Specifically, you can test the addStudent function by sending crafted POST requests with JavaScript payloads in the Name parameter and observing if the script executes when viewing the student listing page.

A practical detection method is to use curl or similar HTTP clients to send a POST request with a payload that includes a script tag in the Name field, for example:

• curl -X POST -d "Name=<script>alert('XSS')</script>" http://target-url/path/to/addStudent

Then, access the student listing page (view_students.php) in a browser or via a tool like curl or wget to see if the injected script is rendered and executed.

Additionally, monitoring HTTP traffic for suspicious POST requests containing script tags or unusual payloads targeting the addStudent endpoint can help detect exploitation attempts.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include sanitizing and validating all user inputs, especially the Name parameter in the addStudent function, to prevent injection of malicious scripts.

Implement proper output encoding (such as HTML entity encoding) when rendering user-supplied data in the view_students.php page to prevent execution of injected scripts.

Restrict access to the addStudent endpoint by enforcing authentication and authorization controls to prevent anonymous attackers from exploiting the vulnerability.

As a temporary measure, monitor and block suspicious POST requests containing script tags or other potentially malicious payloads targeting the vulnerable endpoint.

Consider applying web application firewall (WAF) rules to detect and block XSS attack patterns.

Useful 0 Not Useful 0