itsourcecode University Management System att_single_view.php クロスサイトスクリプティング

Successful exploitation of CVE-2026-3412 allows an attacker to execute arbitrary JavaScript code within the context of a user's browser session on the University Management System. This can lead to various malicious outcomes, including session hijacking, defacement of the website, redirection to phishing sites, and theft of sensitive user data like login credentials or personal information. Given the public availability of a proof-of-concept, the risk of widespread exploitation is significant, particularly for systems with unpatched installations. The blast radius extends to all users accessing the affected page.

Organizations utilizing the itsourcecode University Management System version 1.0, particularly those with publicly accessible instances or those lacking robust input validation practices, are at significant risk. Shared hosting environments where multiple users share the same server resources are also particularly vulnerable, as a compromise of one user's account could potentially impact others.

• php / web:

curl -I 'http://your-university-management-system/att_single_view.php?dt=<script>alert(1)</script>' | grep -i content-type

• generic web:

 grep -i 'dt=<script' /var/log/apache2/access.log

1. 2026-03-02Disclosure

   disclosure

1. 予約済み2026-03-01
2. 公開日2026-03-02
3. EPSS 更新日2026-03-23

The primary mitigation for CVE-2026-3412 is to upgrade to a patched version of the itsourcecode University Management System. As no fixed version is currently specified, immediate action is crucial. In the absence of an upgrade, implement temporary mitigations such as deploying a Web Application Firewall (WAF) with rules to filter out malicious script injections targeting the 'dt' parameter in /attsingleview.php. Input validation on the server-side, specifically sanitizing or encoding user-supplied input before rendering it in the page, is also essential. Regularly review access and error logs for suspicious activity.