CVE-2025-4470: Online Student Clearance System XSS Vulnerability

CVE-2025-4470 Overview

CVE-2025-4470 is a cross-site scripting (XSS) vulnerability in SourceCodester Online Student Clearance System version 1.0. The flaw resides in /admin/add-student.php, where the Fullname parameter is reflected or stored without proper sanitization. An authenticated attacker can inject arbitrary JavaScript that executes in the context of administrators or other users viewing the affected pages. The issue is tracked as [CWE-79]. According to the advisory, other parameters in the same endpoint may be affected as well. A public disclosure exists via a GitHub XSS Vulnerability Report.

Critical Impact
Attackers with administrative access can inject persistent JavaScript into the student management interface, enabling session hijacking, credential theft, and unauthorized actions against other users of the clearance system.

Affected Products

SourceCodester Online Student Clearance System 1.0
Vendor: senior-walter
CPE: cpe:2.3:a:senior-walter:online_student_clearance_system:1.0

Discovery Timeline

2025-05-09 - CVE-2025-4470 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-4470

Vulnerability Analysis

The vulnerability is a cross-site scripting flaw in the administrative student creation workflow. The /admin/add-student.php script accepts the Fullname POST parameter and processes it without encoding HTML control characters. When the stored value is subsequently rendered in the admin interface, the browser interprets injected markup as executable script. The attack requires administrative privileges to submit the form, but any resulting payload executes in the context of other administrators or users who access student records. The EPSS data assigns this issue a probability of 0.647%.

Root Cause

The root cause is missing output encoding and insufficient input validation on form fields in the admin workflow. User-supplied text intended for a student's full name is written to the application database or echoed back to pages without HTML entity escaping. Any <script> tag or event handler supplied by the attacker becomes active JavaScript when the record is viewed.

Attack Vector

Exploitation is network-based and requires an authenticated session with privileges to add student records. The attacker submits a crafted Fullname value containing JavaScript payloads through the add-student form. The payload is stored and later triggered when administrators or users browse the affected pages, enabling session cookie theft, forced actions through the admin interface, or redirection to attacker-controlled content. The advisory indicates other parameters in the same endpoint may share the same weakness.

For technical details and a public proof-of-concept, see the GitHub XSS Vulnerability Report and VulDB entry #308089.

Detection Methods for CVE-2025-4470

Indicators of Compromise

HTTP POST requests to /admin/add-student.php containing <script>, onerror=, onload=, or javascript: sequences in the Fullname parameter.
Database rows in the student table whose name fields contain HTML tags or encoded script fragments.
Admin browser sessions issuing unexpected outbound requests shortly after rendering student lists.

Detection Strategies

Deploy a web application firewall rule to inspect POST bodies targeting add-student.php for XSS payload patterns.
Review web server access logs for repeated or anomalous requests to the admin endpoint from accounts that rarely create records.
Query the application database for stored values containing angle brackets, script, or event handler attributes in name fields.

Monitoring Recommendations

Enable verbose logging on administrative routes and forward logs to a centralized SIEM for correlation.
Monitor for admin session anomalies such as new source IPs, concurrent sessions, or unusual API usage following page views.
Alert on Content Security Policy violation reports generated by the admin interface, which can surface injected inline scripts.

How to Mitigate CVE-2025-4470

Immediate Actions Required

Restrict access to the /admin/ directory to trusted networks or VPN users until a patch is applied.
Audit existing student records and sanitize or remove entries containing HTML or script content.
Rotate administrator credentials and invalidate active sessions to limit the impact of any stolen cookies.

Patch Information

No vendor patch is listed in the NVD advisory at the time of publication. Operators of SourceCodester Online Student Clearance System 1.0 should monitor the SourceCodester project site and VulDB entry #308089 for updates. In the absence of an official fix, modify the application source to apply HTML entity encoding on all user-supplied fields rendered in admin pages, using functions such as htmlspecialchars($value, ENT_QUOTES, 'UTF-8') before output.

Workarounds

Implement a strict Content Security Policy that disallows inline scripts and restricts script sources to a trusted origin.
Add server-side input validation to reject non-printable characters, angle brackets, and quote characters in name fields.
Place the application behind a web application firewall configured with OWASP Core Rule Set XSS signatures.
Limit administrative account provisioning and enforce multi-factor authentication to reduce the attacker pool.

bash

# Example Apache header configuration enforcing a restrictive CSP
Header set Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'"
Header set X-XSS-Protection "1; mode=block"
Header set X-Content-Type-Options "nosniff"