itsourcecode University Management System view_result.php cross site scripting

An attacker can exploit this XSS vulnerability by crafting a malicious URL containing a specially crafted 'vr' parameter. When a user visits this URL, the injected script will execute in their browser context, allowing the attacker to steal cookies, redirect the user to a phishing site, or modify the content of the page. The potential impact includes unauthorized access to user accounts, data theft, and damage to the system's reputation. Successful exploitation could lead to a compromise of the entire University Management System, impacting student and faculty data.

Educational institutions utilizing itsourcecode University Management System version 1.0 are at significant risk. Specifically, systems with publicly accessible instances of /view_result.php are particularly vulnerable. Shared hosting environments where multiple users share the same server instance are also at increased risk due to the potential for cross-tenant exploitation.

• php / web:

curl -I 'http://your-university-management-system/view_result.php?vr=<script>alert(1)</script>' | grep -i 'content-type'

• generic web:

curl -s 'http://your-university-management-system/view_result.php?vr=<script>alert(1)</script>' | grep 'alert(1)'

1. 2026-03-12Disclosure

   disclosure

1. Réservé2026-03-11
2. Publiée2026-03-12
3. EPSS mis à jour2026-03-23

The primary mitigation is to upgrade to a patched version of itsourcecode University Management System as soon as it becomes available. Until the upgrade is possible, implement a Web Application Firewall (WAF) rule to filter requests containing suspicious characters in the 'vr' parameter of /viewresult.php. Input validation on the server-side, specifically sanitizing the 'vr' parameter, can also reduce the attack surface. Consider restricting access to the /viewresult.php file to authorized users only. After upgrade, confirm by testing the /view_result.php endpoint with various input strings to ensure no XSS vulnerabilities remain.