CVE-2025-5984: Student Clearance System XSS Vulnerability

CVE-2025-5984 Overview

CVE-2025-5984 is a reflected cross-site scripting (XSS) vulnerability in SourceCodester Online Student Clearance System version 1.0. The flaw resides in the /Admin/add-fee.php script, where the txtamt parameter is rendered without proper output encoding. An authenticated attacker with low privileges can inject arbitrary JavaScript that executes in the context of a victim's browser session. The exploit has been publicly disclosed, increasing the likelihood of opportunistic abuse against exposed installations.

Critical Impact
Successful exploitation allows script execution in administrator browser sessions, enabling session data theft, defacement, or forced actions within the clearance system.

Affected Products

SourceCodester Online Student Clearance System 1.0
Vendor identifier: senior-walter:online_student_clearance_system
Vulnerable component: /Admin/add-fee.php (txtamt parameter)

Discovery Timeline

2025-06-10 - CVE-2025-5984 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in the NVD database

Technical Details for CVE-2025-5984

Vulnerability Analysis

The vulnerability is a stored or reflected cross-site scripting weakness classified under [CWE-79]. The add-fee.php administrative endpoint accepts user-supplied input through the txtamt HTTP parameter. The application returns this value into the resulting HTML response without applying context-aware output encoding. Any script payload supplied in txtamt is executed by the browser when the response is rendered.

Because the endpoint sits under /Admin/, exploitation targets authenticated administrator sessions. An attacker who tricks an administrator into submitting a crafted request can execute JavaScript with full access to the administrator's session cookies and application state. The attack requires user interaction and low-privilege authentication, but no elevated privileges on the server.

Root Cause

The root cause is missing input sanitization and output encoding on the txtamt field within add-fee.php. The application treats the parameter as trusted numeric data but reflects the raw value into HTML output. Standard defenses such as HTML entity encoding, allowlist validation for numeric input, or a Content Security Policy (CSP) are absent.

Attack Vector

Exploitation occurs over the network against the administrative interface. The attacker crafts a URL or form submission containing a JavaScript payload in txtamt and delivers it to an authenticated administrator through phishing or a malicious link. When the administrator submits the request, the server reflects the payload and the browser executes it in the application origin.

No verified public exploit code is available for this CVE. Refer to the VulDB entry #311899 for the original disclosure details.

Detection Methods for CVE-2025-5984

Indicators of Compromise

HTTP POST or GET requests to /Admin/add-fee.php containing script tags, event handlers (onerror=, onload=), or JavaScript URI schemes in the txtamt parameter.
Web server access logs showing URL-encoded payloads such as %3Cscript%3E or javascript: in fee-related endpoints.
Unexpected outbound requests from administrator browser sessions to attacker-controlled domains shortly after visiting the clearance system.

Detection Strategies

Deploy a web application firewall (WAF) rule that inspects the txtamt parameter for HTML tags, JavaScript keywords, and encoded script delimiters.
Enable verbose request logging on the /Admin/ directory and alert on non-numeric values submitted to txtamt.
Correlate administrator authentication events with anomalous DOM-based network activity originating from the clearance application.

Monitoring Recommendations

Monitor referer headers and session identifiers associated with add-fee.php submissions for reuse from unexpected IP addresses.
Track browser console errors and CSP violation reports if a Content Security Policy is deployed in report-only mode.
Review administrator activity dashboards for fee entries that were never legitimately created.

How to Mitigate CVE-2025-5984

Immediate Actions Required

Restrict access to the /Admin/ directory using IP allowlists, VPN gating, or reverse proxy authentication until a fix is applied.
Instruct administrators to avoid clicking untrusted links while authenticated to the clearance system.
Apply server-side input validation to the txtamt parameter, rejecting any value that is not a properly formatted numeric amount.

Patch Information

No vendor-supplied patch has been published for this vulnerability at the time of writing. Operators of SourceCodester Online Student Clearance System 1.0 must apply source-level fixes: sanitize the txtamt parameter with a numeric validator and HTML-encode all user-controlled output using functions such as htmlspecialchars($value, ENT_QUOTES, 'UTF-8'). Track updates through SourceCodester and the VulDB advisory.

Workarounds

Deploy a Content Security Policy header that disallows inline script execution, such as Content-Security-Policy: default-src 'self'; script-src 'self'.
Place the application behind a WAF with generic XSS signatures enabled for all form parameters under /Admin/.
Set the HttpOnly and Secure flags on all session cookies to limit the impact of successful script injection.

bash

# Example nginx configuration snippet enforcing CSP and cookie hardening
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'" always;
add_header X-Content-Type-Options "nosniff" always;
add_header X-Frame-Options "DENY" always;
proxy_cookie_flags ~ HttpOnly Secure SameSite=Strict;