Executive Summary

CVE-2026-11534 is a Stored Cross-Site Scripting (XSS) vulnerability in the imvks786 student_management_system, specifically in the add.php file. The vulnerability arises because user inputs such as name, address, or father's name are directly concatenated into the database without proper sanitization or encoding.

An attacker can inject malicious JavaScript code into student records. When other users view these records on affected pages, the malicious script executes in their browsers.

This can lead to session theft, cookie hijacking, and privilege escalation, especially if an administrator views the infected record. The attack is persistent because the malicious payload is stored in the database.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can impact you by allowing attackers to execute malicious scripts in your browser when you view compromised student records.

• Stealing your session tokens or cookies, which can lead to unauthorized access to your account.
• Escalating privileges if you have administrative rights, potentially allowing attackers to control or manipulate the system.
• Persistent attacks since the malicious code is stored in the database and can affect multiple users over time.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by testing the affected endpoints for stored cross-site scripting (XSS) by injecting typical XSS payloads into the parameters name, address, or fname in the /add.php script.

For example, you can use curl or similar HTTP clients to send requests with payloads like `<svg/onload=alert(1337)>` to the /add.php endpoint and then check if the payload is stored and executed when viewing records in pages such as see.php, seeall.php, phone/record.php, or std_home/std_profile.php.

A sample command to test injection might be:

• curl -X POST -d "name=<svg/onload=alert(1337)>&address=test&fname=test" http://target-system/add.php

After injecting, visit the pages that display the stored data to see if the alert triggers, indicating the presence of the vulnerability.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include sanitizing and encoding user inputs and outputs to prevent malicious scripts from being stored and executed.

Specifically, applying output encoding functions such as htmlspecialchars() in PHP when displaying user-supplied data can prevent the execution of injected scripts.

Additionally, reviewing and restricting input fields to allow only expected characters and implementing Content Security Policy (CSP) headers can reduce the impact of XSS attacks.

Since the project has not yet responded with a patch, consider temporarily disabling or restricting access to the vulnerable /add.php functionality if possible.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability is a Stored Cross-Site Scripting (XSS) issue that allows attackers to inject malicious scripts into the student management system's database. This can lead to session theft, cookie hijacking, and privilege escalation, potentially exposing sensitive user data.

Such unauthorized access and exposure of personal data can violate data protection regulations like GDPR and HIPAA, which require safeguarding personal information against unauthorized access and ensuring data integrity and confidentiality.

Because the vulnerability enables persistent attacks and data manipulation without proper sanitization or encoding, it undermines compliance with these standards that mandate secure handling of personal data and protection against cross-site scripting attacks.

Useful 0 Not Useful 0