codingWithElias School Management System Edit Student Info student-view.php cross site scripting

Successful exploitation of CVE-2025-13795 allows an attacker to execute arbitrary JavaScript code within the context of a user's browser session. This can lead to a variety of malicious actions, including session hijacking, defacement of the School Management System's interface, and theft of sensitive user data such as student records, grades, and personal information. Given the public availability of an exploit, the risk of widespread exploitation is significant. The impact is amplified if the system is used to manage sensitive student data or is integrated with other critical systems.

Educational institutions and organizations utilizing the codingWithElias School Management System are at risk, particularly those relying on the system to manage sensitive student data. Organizations with legacy configurations or those who have not implemented robust input validation practices are especially vulnerable.

• php: Examine /student-view.php for inadequate input validation on the 'First Name' parameter. Search for code that directly outputs user input without proper sanitization.

// Example of vulnerable code
<?php
echo $_GET['first_name']; ?>

• generic web: Monitor access logs for requests to /student-view.php with suspicious parameters in the 'first_name' field, such as those containing HTML tags or JavaScript code.

grep 'first_name=<script' /var/log/apache2/access.log

• generic web: Check response headers for signs of XSS payloads being reflected back to the user. Use browser developer tools to inspect the response and look for unexpected script tags.

1. 2025-11-30Disclosure

   disclosure

2. 2025-11-30PoC

   poc

3. 2025-11-30Patch

   patch

1. Gereserveerd2025-11-30
2. Gepubliceerd2025-11-30
3. Gewijzigd2025-12-01
4. EPSS bijgewerkt2026-03-23

The primary mitigation for CVE-2025-13795 is to upgrade to version 1.0.1. Due to the rolling release nature of the School Management System, direct rollbacks may not be possible. As a temporary workaround, input validation and output encoding should be implemented on the 'First Name' field in /student-view.php to sanitize user-supplied data. Web application firewalls (WAFs) configured to detect and block XSS payloads targeting the /student-view.php endpoint can also provide some protection. After upgrading, confirm the vulnerability is resolved by attempting to inject a simple XSS payload (e.g., <script>alert(1)</script>) into the 'First Name' field and verifying that the script does not execute.