CVE-2025-13244: Student Information System XSS Flaw

CVE-2025-13244 Overview

CVE-2025-13244 is a reflected cross-site scripting (XSS) vulnerability in code-projects Student Information System 2.0. The flaw exists in an unspecified function of the /register.php script, where user-supplied input reaches the response without proper sanitization. Attackers can trigger the issue remotely, and the exploit has been publicly disclosed. Successful exploitation requires user interaction, such as clicking a crafted link. The vulnerability is tracked under CWE-79 (Improper Neutralization of Input During Web Page Generation).

Critical Impact
Attackers can execute arbitrary JavaScript in a victim's browser session, enabling credential theft, session hijacking, or delivery of secondary payloads against users of the affected application.

Affected Products

code-projects Student Information System 2.0
Fabian Student Information System (fabian:student_information_system:2.0)
Deployments exposing /register.php to untrusted users

Discovery Timeline

2025-11-16 - CVE-2025-13244 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-13244

Vulnerability Analysis

The vulnerability resides in the registration endpoint (/register.php) of code-projects Student Information System 2.0. The application accepts user-supplied parameters and reflects them into the HTML response without applying output encoding or input filtering. This allows an attacker to inject arbitrary HTML or JavaScript that executes in the context of the targeted user's browser session.

Because the flaw affects a pre-authentication page (registration), attackers can craft malicious links and distribute them via phishing or social engineering. When a victim visits the crafted URL, the injected script runs under the application's origin. Refer to the public XSS reference on GitHub and the VulDB entry #332570 for additional technical context.

Root Cause

The root cause is missing input validation and output encoding in /register.php. The application concatenates untrusted input directly into HTML output, violating the guidance in CWE-79. No context-aware escaping is applied before rendering user-controlled data.

Attack Vector

Exploitation occurs over the network and requires user interaction. An attacker crafts a URL containing a malicious payload targeting a vulnerable parameter processed by /register.php. The victim follows the link, and the server reflects the payload into the response. The browser executes the injected script within the application's origin, giving the attacker access to cookies, DOM data, and any actions the user can perform.

Detection Methods for CVE-2025-13244

Indicators of Compromise

HTTP requests to /register.php containing script tags, event handlers, or encoded JavaScript payloads such as <script>, onerror=, or javascript:
Web server access logs showing suspicious query strings or POST bodies referencing DOM sinks like document.cookie or document.location
Referrer headers pointing to external phishing infrastructure preceding registration page hits

Detection Strategies

Deploy web application firewall (WAF) rules that inspect requests to /register.php for XSS signatures and encoded variants
Enable Content Security Policy (CSP) reporting to surface blocked inline script execution attempts
Correlate web server logs with browser telemetry to identify script execution originating from the registration flow

Monitoring Recommendations

Monitor outbound requests from user browsers to unfamiliar domains shortly after visiting /register.php
Alert on repeated 200-response requests to registration endpoints containing HTML metacharacters in parameters
Track anomalous session activity, such as unexpected password changes or role updates, that could follow session theft

How to Mitigate CVE-2025-13244

Immediate Actions Required

Restrict access to /register.php behind a WAF with XSS filtering enabled until a vendor patch is applied
Audit all registration and user-input endpoints for reflected or stored XSS conditions
Notify users to avoid clicking untrusted links referencing the application

Patch Information

No vendor advisory or official patch has been published for CVE-2025-13244 at the time of writing. Administrators should track the code-projects site and VulDB #332570 for updates. Until a fix is available, apply compensating controls at the application and network layers.

Workarounds

Implement server-side input validation and context-aware output encoding for all parameters handled by /register.php
Deploy a strict Content Security Policy that disallows inline scripts and restricts script sources to trusted origins
Set the HttpOnly and Secure flags on session cookies to reduce the impact of script execution
Consider taking the affected system offline if it processes sensitive student data and cannot be adequately isolated

bash

# Example CSP header to reduce XSS impact
Header always set Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'none'"
Header always set X-XSS-Protection "1; mode=block"
Header always set X-Content-Type-Options "nosniff"