oretnom23 School Fees Management System: Stored XSS in tname parameter (CVE-2023-49987)

A stored cross-site scripting (XSS) vulnerability exists in the School Fees Management System version 1.0. An authenticated attacker with administrative access can inject arbitrary web scripts through the tname parameter within the /management/term component. Successful exploitation requires an authenticated user with administrative privileges to interact with the vulnerable form to save the payload, which is subsequently executed in the context of the user viewing the term management page.

Impact

Successful exploitation allows for the execution of arbitrary JavaScript in the victim's browser session, potentially leading to session hijacking, unauthorized actions performed on behalf of the administrator, or unauthorized access to sensitive system data managed by the application.

Recommendation

• Audit logs for the specified endpoint (/management/term) to identify potential injection of script tags.
• Implement input validation and output encoding for the tname parameter within the School Fees Management System to prevent script injection.
• As version 1.0 appears to be the only version listed, evaluate the use of this software within the environment given the lack of identified security updates.