CVE-2024-4651: School Management System XSS Vulnerability

CVE-2024-4651 Overview

CVE-2024-4651 is a reflected cross-site scripting (XSS) vulnerability [CWE-79] in Campcodes Complete Web-Based School Management System 1.0. The flaw resides in /view/student_attendance_history1.php, where the year parameter is reflected into the response without proper output encoding. An unauthenticated remote attacker can craft a malicious URL that executes arbitrary JavaScript in a victim's browser when visited. The exploit has been publicly disclosed under VulDB identifier VDB-263495, increasing the risk of opportunistic abuse against exposed deployments.

Critical Impact
Successful exploitation lets attackers hijack sessions, steal credentials entered into the school portal, deface pages, or pivot to administrative actions by targeting authenticated staff users.

Affected Products

Campcodes Complete Web-Based School Management System 1.0
Vulnerable component: /view/student_attendance_history1.php
Vulnerable parameter: year (GET)

Discovery Timeline

2024-05-08 - CVE-2024-4651 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-4651

Vulnerability Analysis

The application accepts the year request parameter in student_attendance_history1.php and renders it back to the client without HTML entity encoding or input sanitization. An attacker injects script content through the parameter, and the server includes the payload directly in the rendered HTML. When a victim loads the crafted URL, the browser executes the injected JavaScript in the context of the application's origin. User interaction is required, typically by clicking a link delivered through phishing or embedded in another site. Because the payload executes within the authenticated session scope, attackers can read cookies, submit forms on the user's behalf, or exfiltrate sensitive data such as student records.

Root Cause

The root cause is improper neutralization of input during web page generation [CWE-79]. The PHP code echoes the year parameter into HTML without applying htmlspecialchars() or an equivalent context-aware encoder. No output filtering, Content Security Policy, or input validation layer blocks script content from flowing from the request to the response.

Attack Vector

Exploitation is network-based and does not require authentication. The attacker constructs a URL such as /view/student_attendance_history1.php?year=<script>...</script> and tricks a user into visiting it. The scope-changing nature of reflected XSS means the attacker's script runs within the victim's authenticated session with the school management application, enabling account takeover primitives against teachers, administrators, or students.

See the public GitHub Vulnerability Document and the VulDB #263495 entry for payload details.

Detection Methods for CVE-2024-4651

Indicators of Compromise

Web server access logs containing GET /view/student_attendance_history1.php?year= with values that include <script, onerror=, onload=, javascript:, or URL-encoded equivalents such as %3Cscript%3E.
Outbound requests from user browsers to attacker-controlled domains immediately after visiting the affected endpoint.
Unexpected session or cookie activity for staff accounts shortly after accessing attendance-history URLs.

Detection Strategies

Deploy a Web Application Firewall (WAF) rule that flags script tags and common XSS vectors in the year parameter for /view/student_attendance_history1.php.
Hunt historical HTTP logs for anomalous year values that are non-numeric or contain HTML metacharacters.
Correlate browser process telemetry on administrator workstations with unusual child processes or credential prompts following access to the application.

Monitoring Recommendations

Enable verbose request logging for all PHP endpoints under /view/ and forward logs to a centralized analytics platform.
Alert on repeated requests to student_attendance_history1.php from a single source with varying year payloads, which indicates payload tuning.
Monitor for inbound links referring users to the application from untrusted external domains.

How to Mitigate CVE-2024-4651

Immediate Actions Required

Restrict access to the /view/student_attendance_history1.php endpoint through network ACLs or authentication requirements until a vendor fix is applied.
Apply a WAF signature that blocks HTML and JavaScript metacharacters in the year query parameter.
Instruct staff and students to avoid clicking unsolicited links referencing the school management portal.

Patch Information

No vendor advisory or official patch has been published for Campcodes Complete Web-Based School Management System 1.0 at the time of writing. Organizations running this application should treat it as unmaintained and plan migration or compensating controls accordingly. Monitor the VulDB record for updates.

Workarounds

Modify the PHP source to cast $_GET['year'] to an integer or validate it against a strict allowlist before use, for example preg_match('/^[0-9]{4}$/', $year).
Wrap every output of the year value with htmlspecialchars($year, ENT_QUOTES, 'UTF-8') to neutralize script content.
Enforce a restrictive Content Security Policy header such as Content-Security-Policy: default-src 'self'; script-src 'self' to limit the impact of injected scripts.
Set the HttpOnly and Secure flags on session cookies to reduce the value of cookie theft via XSS.

bash

# Example Apache mod_security rule to block script payloads in the year parameter
SecRule ARGS:year "@rx (?i)(<script|javascript:|onerror=|onload=|%3Cscript)" \
    "id:1004651,phase:2,deny,status:403,log,msg:'CVE-2024-4651 XSS attempt blocked'"