CVE-2026-5644: Student Management System XSS Vulnerability

CVE-2026-5644 Overview

CVE-2026-5644 is a reflected cross-site scripting (XSS) vulnerability [CWE-79] in the Cyber-III Student-Management-System, an open-source PHP application hosted on GitHub. The flaw resides in the /admin/Add%20notice/batch-notice.php file, where the $_SERVER['PHP_SELF'] value is rendered without proper sanitization. An attacker can craft a malicious URL that injects JavaScript into the response when an authenticated administrator visits it. The project uses continuous delivery with rolling releases, so no fixed version is currently published. The exploit has been disclosed publicly, and the maintainers had not responded to the upstream issue report at the time of disclosure.

Critical Impact

Authenticated administrators visiting a crafted URL may execute attacker-controlled JavaScript in the admin panel context, enabling session theft and unauthorized actions.

Affected Products

• Cyber-III Student-Management-System up to commit 1a938fa61e9f735078e9b291d2e6215b4942af3f
• All rolling-release builds prior to an upstream fix
• Deployments exposing /admin/Add notice/batch-notice.php

Discovery Timeline

• 2026-04-06 - CVE-2026-5644 published to NVD
• 2026-04-29 - Last updated in NVD database

Technical Details for CVE-2026-5644

Vulnerability Analysis

The vulnerability is a reflected cross-site scripting flaw classified under [CWE-79]. The affected script, batch-notice.php, echoes the $_SERVER['PHP_SELF'] server variable into HTML output without encoding. PHP populates $_SERVER['PHP_SELF'] from the request path, and many web servers permit additional path segments after the script name. An attacker who appends URL-encoded HTML to the request path causes that content to be reflected back in form actions or other markup.

Exploitation requires high privileges, since the vulnerable endpoint sits behind the admin login, and it requires user interaction in the form of a victim clicking the crafted link. Successful exploitation runs JavaScript under the origin of the application, which can be used to harvest session cookies, perform CSRF-style state changes, or alter rendered content for the administrator.

Root Cause

The root cause is missing output encoding of a server-controlled variable that reflects attacker-supplied path data. $_SERVER['PHP_SELF'] is commonly used inside <form action="..."> declarations and is treated by developers as trusted, but it inherits attacker-controlled path information from the request URI. Without applying htmlspecialchars() or an equivalent encoding routine, injected markup is interpreted by the browser.

Attack Vector

The attack is delivered over the network and triggered when a logged-in administrator follows a crafted link to the batch-notice.php endpoint. The malicious payload is encoded into the URL path so the script reflects it back into the rendered HTML. No additional authentication step beyond the existing admin session is required to execute the injected script. Public exploit details are referenced in the VulDB Vulnerability Details entry and the upstream GitHub Issue Tracker.

Detection Methods for CVE-2026-5644

Indicators of Compromise

• Web server access logs containing requests to /admin/Add%20notice/batch-notice.php with appended path segments containing %3C, %3E, script, or onerror tokens.
• Outbound requests from administrator browsers to unknown domains immediately after visiting the admin panel.
• Unexpected modifications to notice records performed under an administrator account shortly after a link-click event.

Detection Strategies

• Inspect HTTP request URIs for path-based injection patterns targeting PHP scripts, particularly attempts to break out of attribute contexts around PHP_SELF reflections.
• Deploy a Content Security Policy (CSP) in report-only mode to surface inline script execution attempts on admin pages.
• Correlate referer headers and click events that lead administrators from external sources directly into authenticated admin paths.

Monitoring Recommendations

• Forward web server and PHP application logs to a centralized analytics platform and alert on path traversal-like segments appended to .php files.
• Monitor admin session activity for anomalous DOM-initiated requests, such as bulk record edits triggered immediately after navigation.
• Review GitHub issue #238 and the upstream repository regularly for an official patch commit.

How to Mitigate CVE-2026-5644

Immediate Actions Required

• Restrict access to /admin/ paths to trusted networks or VPN ranges until an upstream fix is available.
• Educate administrators to avoid clicking unsolicited links that target the application's admin endpoints.
• Apply a web application firewall rule that blocks requests containing HTML metacharacters in PHP script path segments.

Patch Information

No official patch has been released. The project uses continuous delivery with rolling releases, and the maintainers had not responded to the upstream issue at the time of CVE publication. Track the GitHub Project Repository and the GitHub Issue Tracker for fix commits superseding 1a938fa61e9f735078e9b291d2e6215b4942af3f.

Workarounds

• Locally patch batch-notice.php to wrap any output of $_SERVER['PHP_SELF'] in htmlspecialchars($_SERVER['PHP_SELF'], ENT_QUOTES, 'UTF-8') or replace it with a hardcoded form action.
• Configure the web server to reject requests where the path contains characters outside the expected script name set.
• Enforce a strict Content Security Policy that disallows inline scripts and unknown script sources on admin pages.

# Example Apache rule to block angle brackets in PHP script paths
<LocationMatch "^/admin/.*\.php">
    RewriteEngine On
    RewriteCond %{REQUEST_URI} (%3C|%3E|<|>) [NC]
    RewriteRule .* - [F,L]
</LocationMatch>