CVE-2025-13349: Student Grades Management System XSS Flaw

CVE-2025-13349 Overview

CVE-2025-13349 is a stored cross-site scripting (XSS) vulnerability in SourceCodester Student Grades Management System 1.0. The flaw resides in the /grades.php script within the Add New Grade Page component. An authenticated attacker can inject malicious script payloads through the Remarks parameter, which the application stores and later renders without proper output encoding. The exploit has been publicly disclosed, increasing the likelihood of opportunistic abuse against unpatched deployments.

Critical Impact

Authenticated attackers can persist arbitrary JavaScript in the grades interface, enabling session theft, credential harvesting, and unauthorized actions against other authenticated users who view the injected content.

Affected Products

• Remyandrade Student Grades Management System 1.0
• SourceCodester distribution of Student Grades Management System
• Deployments exposing /grades.php Add New Grade Page functionality

Discovery Timeline

• 2025-11-18 - CVE-2025-13349 published to NVD
• 2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-13349

Vulnerability Analysis

The vulnerability is a stored cross-site scripting flaw classified under [CWE-79]. It affects the Add New Grade workflow in /grades.php. The application accepts input in the Remarks field without sanitizing HTML or JavaScript content. Because the value is persisted to the backend database and rendered on subsequent grade views, any script provided by the attacker executes in the browser of every user who views the affected record.

Exploitation requires authenticated access with permissions to add or modify grade records, and user interaction is needed to trigger the injected payload when the target loads the grades view. Successful exploitation runs in the context of the victim's session, allowing an attacker to read session cookies, perform requests on behalf of the victim, and manipulate DOM content in the application interface.

Root Cause

The root cause is missing input validation and missing output encoding on the Remarks parameter submitted through /grades.php. The application does not filter angle brackets, event handlers, or script tags, and renders stored values directly into the HTML response body.

Attack Vector

The attack vector is network-based over standard HTTP or HTTPS. An authenticated attacker submits a crafted Remarks value via the Add New Grade form. When a legitimate user, including administrators, later views the grades page, the injected JavaScript executes automatically in their browser session.

The vulnerability is described in prose because no verified proof-of-concept code has been included in this advisory. Additional technical detail is available in the Medium article on the XSS vulnerability and the VulDB entry #332766.

Detection Methods for CVE-2025-13349

Indicators of Compromise

• Grade records containing HTML tags such as <script>, <img onerror=...>, or <svg onload=...> in the Remarks column of the backend database.
• Web server access logs showing POST requests to /grades.php with URL-encoded angle brackets or JavaScript keywords in the Remarks parameter.
• Unexpected outbound requests from user browsers to attacker-controlled domains shortly after loading the grades interface.

Detection Strategies

• Deploy a Web Application Firewall (WAF) rule that inspects the Remarks parameter of /grades.php for HTML tags and JavaScript event handlers.
• Run periodic database queries against the grades table to identify stored values containing <, >, javascript:, or on[a-z]+= patterns.
• Enable content security policy (CSP) violation reporting to surface unauthorized inline script execution originating from application pages.

Monitoring Recommendations

• Correlate authentication logs with grade creation events to identify accounts submitting suspicious payloads.
• Alert on repeated form submissions from a single session containing encoded angle brackets or common XSS keywords.
• Monitor administrator sessions for unexpected requests generated immediately after loading pages that render user-controlled content.

How to Mitigate CVE-2025-13349

Immediate Actions Required

• Restrict access to the Student Grades Management System to trusted internal networks until a fix is deployed.
• Audit the grades table and remove or neutralize any existing records containing HTML or script content in the Remarks field.
• Enforce least-privilege access so that only authorized staff can submit or modify grade records.

Patch Information

No vendor patch has been published for CVE-2025-13349 at the time of this writing. Organizations running Student Grades Management System 1.0 should monitor the SourceCodester code repository for updates and apply application-layer input validation as an interim control.

Workarounds

• Add server-side input validation in /grades.php that rejects or HTML-encodes angle brackets, quotes, and JavaScript event handler patterns before persisting the Remarks value.
• Apply context-aware output encoding when rendering stored Remarks values in HTML responses.
• Deploy a Content Security Policy that disallows inline scripts and restricts script sources to trusted origins.
• Place the application behind a WAF configured with OWASP Core Rule Set XSS signatures.

# Example CSP header to reduce XSS impact
Header set Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'"