Vulnérabilité de cross site scripting dans edit-subject.php du système de gestion des enregistrements d'étudiants PHPGurukul

Successful exploitation of CVE-2026-3403 allows an attacker to inject arbitrary JavaScript code into the Student Record Management System. This code can then be executed in the context of a user's browser when they access the affected page. The attacker could potentially steal session cookies, redirect users to malicious websites, or deface the application. The remote nature of the vulnerability means an attacker does not need to be on the same network as the server to exploit it. Given the public availability of the exploit, the risk of exploitation is elevated.

Organizations using PHPGurukul Student Record Management System version 1.0 are at risk. This includes educational institutions, training centers, and any entity utilizing this system for student record management. Shared hosting environments are particularly vulnerable, as a compromised account on one site could potentially impact other sites hosted on the same server.

• php / web:

grep -r "Subject 1" /var/www/html/edit-subject.php

• php / web:

curl -I http://your-student-record-system.com/edit-subject.php?Subject%201=<script>alert(1)</script>

• generic web: Examine access logs for requests to /edit-subject.php containing suspicious characters in the Subject 1 parameter. • generic web: Check for unusual JavaScript code being injected into the Student Record Management System's pages.

1. 2026-03-02Disclosure

   disclosure

1. Réservé2026-03-01
2. Publiée2026-03-02
3. EPSS mis à jour2026-03-23

The primary mitigation for CVE-2026-3403 is to upgrade to a patched version of PHPGurukul Student Record Management System. Since a fixed version isn't specified, immediate action is crucial. As a temporary workaround, implement strict input validation on the 'Subject 1' parameter in /edit-subject.php, rejecting any input containing potentially malicious characters. Additionally, apply robust output encoding to prevent the browser from interpreting user-supplied data as executable code. Web application firewalls (WAFs) configured to detect and block XSS payloads can also provide an additional layer of protection.