Stored XSS Vulnerability in Phpgurukul Teachers Record Management System

Phpgurukul Teachers Record Management System version 1.0 contains a stored cross-site scripting (XSS) vulnerability identified as CVE-2022-41445. The vulnerability resides in the 'Add Subject' page of the application, which leverages the CodeIgniter framework. An authenticated attacker with administrative privileges can inject malicious JavaScript payloads into subject entry fields. When a teacher user subsequently accesses the profile details page, the stored script executes in the victim's browser session. This vulnerability poses a risk of session hijacking, unauthorized actions performed on behalf of the teacher, or information theft within the administrative and teacher interfaces. The availability of proof-of-concept exploit material increases the risk of exploitation for organizations still running this version.

Attack Chain

1. Attacker authenticates to the Teachers Record Management System using valid administrative credentials.
2. Attacker navigates to the 'Add Subject' administration page.
3. Attacker inputs a crafted JavaScript payload into the subject title or related input fields.
4. Attacker submits the form, causing the malicious script to be saved into the application's backend database.
5. A teacher user logs into the application and navigates to their profile view or a page listing subject details.
6. The application retrieves the stored malicious payload from the database and renders it unsanitized in the teacher's browser.
7. The browser executes the malicious JavaScript, potentially exfiltrating session cookies or performing unauthorized actions.

Impact

Successful exploitation allows for the execution of unauthorized JavaScript in the context of a teacher's browser session. This can lead to the compromise of teacher accounts, unauthorized data access, and potential escalation of impact within the system's administrative environment. The severity is CVSS 4.8, reflecting the requirement for administrative privileges and user interaction.

Recommendation

• Ensure all users of the Phpgurukul Teachers Record Management System upgrade to the latest version if available, or apply vendor-provided patches.
• Implement strict input validation and output encoding for all user-controllable fields, specifically targeting the 'Add Subject' and profile view modules in the application source code.
• Monitor administrative account activity for suspicious subject creation or modifications.
• Restrict access to administrative modules to verified, high-trust users only.