CVE-2026-104612 Overview
CVE-2026-104612 is a stored cross-site scripting (XSS) vulnerability in SourceCodester Student Result Management System (SRMS) 1.0. The flaw resides in the Announcement Module, specifically in the file script/academic/core/new_announcement.php. Attackers can manipulate the title and announcement parameters to inject arbitrary JavaScript that executes in the browser of any user who views the stored content. The attack is remote and requires user interaction to trigger the payload. Public exploit details have been released, increasing the probability of opportunistic abuse against exposed deployments.
Critical Impact
Authenticated attackers can inject persistent JavaScript into announcement records, enabling session theft, phishing, and client-side actions against administrators and students who view affected pages.
Affected Products
- SourceCodester Student Result Management System 1.0
- Announcement Module component (script/academic/core/new_announcement.php)
- Deployments exposing the application to untrusted users
Discovery Timeline
- 2026-10-02 - CVE-2026-104612 published to NVD
- 2026-10-06 - Last updated in NVD database
Technical Details for CVE-2026-104612
Vulnerability Analysis
The vulnerability is a stored cross-site scripting flaw classified under [CWE-79]. The affected endpoint accepts announcement data through the title and announcement parameters without sufficient input validation or output encoding. Submitted content is persisted to the application database and later rendered to users viewing the Announcement Module. When the rendered page interpolates attacker-controlled markup into the HTML response, the browser executes the injected script in the context of the SRMS origin. Because the payload is stored, it fires for every subsequent visitor without requiring a crafted link. Administrative users viewing the announcement list are high-value targets, as their sessions typically allow elevated actions within the application.
Root Cause
The root cause is missing neutralization of input during web page generation. The new_announcement.php handler trusts user-supplied values for the announcement title and body, writing them to storage without context-aware encoding on retrieval. HTML, attribute, and script contexts are not escaped before rendering, allowing arbitrary tags and event handlers to be interpreted by the browser.
Attack Vector
An attacker with access to the announcement creation workflow submits a crafted title or announcement value containing JavaScript, such as a <script> block or a tag with an inline event handler. The server stores the payload and serves it back to any user who loads the affected announcement view. Exploitation requires the victim to visit a page that renders the stored data. Reported impact is limited to integrity of the browser context, with no direct effect on confidentiality or availability of the server. Public exploit information is available through third-party vulnerability databases.
No verified proof-of-concept code is reproduced here. See the GitHub CVE Report for SRMS and the VulDB CVE Details CVE-2026-104612 entry for technical details.
Detection Methods for CVE-2026-104612
Indicators of Compromise
- HTTP POST requests to script/academic/core/new_announcement.php containing <script>, onerror=, onload=, or javascript: substrings in the title or announcement parameters.
- Database rows in the announcements table containing HTML tags, encoded script fragments, or references to external JavaScript domains.
- Browser console errors or unexpected network requests originating from announcement pages that reference attacker-controlled domains.
Detection Strategies
- Review web server access logs for anomalous payloads submitted to the Announcement Module endpoint.
- Deploy a web application firewall rule that flags HTML and script metacharacters in announcement parameters.
- Perform periodic content inspection of stored announcements to identify markup that should not appear in text fields.
Monitoring Recommendations
- Alert on administrator sessions that exhibit unusual outbound requests shortly after viewing announcement pages.
- Monitor authentication logs for session reuse from unexpected IP addresses, which may indicate stolen cookies.
- Track changes to the announcement table and correlate inserts with the source account and request origin.
How to Mitigate CVE-2026-104612
Immediate Actions Required
- Restrict access to the Announcement Module to trusted administrative accounts until a fix is applied.
- Audit existing announcements and remove any records containing HTML tags, event handlers, or script content.
- Rotate session credentials for accounts that may have viewed malicious announcements.
Patch Information
No official vendor patch has been published in the referenced advisories at the time of writing. Review the VulDB Vulnerability Overview #412921 and SourceCodester Security Resources for updates. Administrators should apply input validation and output encoding fixes to script/academic/core/new_announcement.php and the corresponding rendering templates.
Workarounds
- Apply server-side input validation that rejects HTML metacharacters in the title and announcement parameters.
- Enforce context-aware output encoding when rendering announcement content in HTML templates.
- Deploy a strict Content Security Policy (CSP) that blocks inline scripts and restricts script sources to trusted origins.
- Place the application behind a web application firewall with XSS signature rules enabled.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
