itsourcecode University Management System admin_single_student_update.php クロスサイトスクリプティング

Successful exploitation of CVE-2026-4474 allows an attacker to execute arbitrary JavaScript code in the context of a user's browser session on the University Management System. This can lead to various malicious actions, including session hijacking, credential theft, and defacement of the application. An attacker could potentially gain access to sensitive student data or administrative functionalities depending on the user's privileges. The published exploit significantly lowers the barrier to entry for attackers, increasing the risk of widespread exploitation.

Administrators and users of itsourcecode University Management System version 1.0 are at risk. Organizations relying on this system for student data management, particularly those with limited security resources or outdated configurations, are especially vulnerable. Shared hosting environments where multiple users share the same server instance are also at increased risk.

• php / web:

grep -r 'st_name' /var/www/html/itsourcecode/admin_single_student_update.php

• generic web:

curl -I http://your-university-management-system/admin_single_student_update.php?st_name=<script>alert(1)</script>

• generic web: Examine access logs for requests to /adminsinglestudentupdate.php containing suspicious characters or script tags in the 'stname' parameter.

1. 2026-03-20Disclosure

   disclosure

1. 予約済み2026-03-19
2. 公開日2026-03-20
3. 更新日2026-03-24
4. EPSS 更新日2026-03-27

The primary mitigation for CVE-2026-4474 is to upgrade to a patched version of itsourcecode University Management System. Since a fixed version is not specified, immediate action is critical. As a temporary workaround, implement strict input validation and sanitization on the 'stname' parameter within the /adminsinglestudentupdate.php file. Deploy a Web Application Firewall (WAF) with rules to detect and block XSS payloads targeting this specific endpoint. Monitor access logs for suspicious activity related to the /adminsinglestudent_update.php file.