Cross-Site Scripting in Class and Exam Timetabling System

Executive Summary

This is a reflected Cross-Site Scripting (XSS) vulnerability in SourceCodester Class and Exam Timetabling System 1.0. The 'course' parameter in the /BSIT2.php file does not properly validate or encode user input, allowing attackers to inject malicious scripts. These scripts execute in the victim's browser when they access a crafted link.

Useful 0 Not Useful 0

Detection Guidance

To detect this reflected XSS vulnerability, monitor HTTP requests to /BSIT2.php for the 'course' parameter containing suspicious input like <script> tags. Use browser developer tools to inspect responses for unencoded user input. Check web server logs for repeated requests with XSS payloads such as <script>prompt(/xss/);</script>.

Useful 0 Not Useful 0

Impact Analysis

Attackers can exploit this to steal sensitive data like cookies or session tokens, perform unauthorized actions, deface web pages, redirect users to malicious sites, or take control of the victim's browser. No authentication is required for exploitation.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability, a reflected XSS flaw, could lead to unauthorized access to sensitive data such as session tokens or cookies, which may contain personal or health information. This could violate GDPR's data protection requirements or HIPAA's safeguards for protected health information if exploited.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately implement input validation to filter malicious scripts in the 'course' parameter. Apply output encoding before rendering user input. Deploy a Content Security Policy (CSP) to restrict script execution. Set secure and HttpOnly flags for cookies to prevent theft. Temporarily disable the affected page if a patch is unavailable.

Useful 0 Not Useful 0