CVE-2026-75077: Class Timetabling System XSS Vulnerability

CVE-2026-75077 Overview

CVE-2026-75077 is a reflected cross-site scripting (XSS) vulnerability in SourceCodester Class and Exam Timetabling System 1.0. The flaw resides in the /BSCE2.php script, where the course parameter accepts unsanitized user input. An attacker can inject arbitrary JavaScript that executes in the victim's browser session when the crafted URL is loaded. The issue is remotely exploitable over the network and requires user interaction. Public exploit details have been disclosed through VulDB and a public GitHub issue, increasing the likelihood of opportunistic abuse against exposed deployments.

Critical Impact
Attackers can execute arbitrary JavaScript in the context of an authenticated user's browser, enabling session data theft, UI redress, and phishing pivots against administrators of the timetabling system.

Affected Products

SourceCodester Class and Exam Timetabling System 1.0
Vulnerable component: /BSCE2.php
Vulnerable parameter: course

Discovery Timeline

2026-08-17 - CVE-2026-75077 published to NVD
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-75077

Vulnerability Analysis

The vulnerability is a reflected cross-site scripting flaw [CWE-79] in the /BSCE2.php endpoint of the Class and Exam Timetabling System. The application echoes the course request parameter back into the rendered HTML response without applying output encoding or input validation. An attacker who convinces a user to click a crafted link causes attacker-supplied script to execute in the browser under the origin of the vulnerable application. Because the target is a small PHP administrative application, the affected user is typically an authenticated staff account with elevated access to scheduling data. Exploitation does not require authentication on the attacker's side, and the exploit has been documented publicly.

Root Cause

The root cause is missing output encoding on the course parameter within /BSCE2.php. User-controlled input is concatenated into HTML output without invoking htmlspecialchars() or an equivalent context-aware escaping routine. The application also lacks a Content Security Policy (CSP) that would restrict inline script execution.

Attack Vector

An attacker crafts a URL to /BSCE2.php where the course query parameter contains a JavaScript payload. The victim clicks the link or is redirected from a controlled page. The server reflects the payload into the response, and the browser executes the injected script in the origin of the vulnerable host. See the VulDB Vulnerability Record and the GitHub Issue Discussion for the disclosed proof-of-concept details.

Detection Methods for CVE-2026-75077

Indicators of Compromise

HTTP requests to /BSCE2.php containing course= parameter values with <script>, onerror=, onload=, or URL-encoded equivalents such as %3Cscript%3E.
Web server access logs showing unusually long course parameter values or non-ASCII sequences originating from a single referrer.
Outbound browser requests to attacker-controlled domains following user clicks on links referencing /BSCE2.php.

Detection Strategies

Deploy web application firewall (WAF) signatures that flag reflected XSS patterns in the course parameter of /BSCE2.php.
Enable HTTP response inspection to detect script tags echoed from query strings, indicating successful reflection.
Correlate email or messaging gateway telemetry for URLs targeting /BSCE2.php with encoded scripting payloads.

Monitoring Recommendations

Alert on repeated 200-status responses to /BSCE2.php containing suspicious query string characters (<, >, ", ').
Monitor authenticated administrator sessions for anomalous client-side activity such as unexpected form submissions or credential prompts.
Retain HTTP access and referrer logs to support post-incident investigation of phishing chains that lead to the vulnerable endpoint.

How to Mitigate CVE-2026-75077

Immediate Actions Required

Restrict access to the Class and Exam Timetabling System to trusted internal networks or VPN users until a fix is applied.
Apply input validation and output encoding to the course parameter in /BSCE2.php, using htmlspecialchars($input, ENT_QUOTES, 'UTF-8') before rendering.
Instruct administrators to avoid clicking untrusted links referencing the application, especially those with query strings.

Patch Information

No official vendor patch is referenced in the disclosure. SourceCodester distributes this project as open source, and deployers are responsible for applying source-level fixes. Consult the VulDB CVE Database Entry and the SourceCodester Resources for updates. Until a maintainer release is available, apply the code-level mitigation described above and rebuild the affected page.

Workarounds

Configure a Content Security Policy header such as Content-Security-Policy: default-src 'self'; script-src 'self' to block inline script execution.
Deploy a WAF rule that rejects requests to /BSCE2.php where the course parameter contains angle brackets, event handlers, or javascript: URIs.
Set the HttpOnly and SameSite=Strict flags on session cookies to reduce the impact of successful script execution.

bash

# Example Apache mod_security rule to block reflected XSS on the course parameter
SecRule ARGS:course "@rx (?i)(<script|onerror=|onload=|javascript:)" \
    "id:1075077,phase:2,deny,status:403,log,msg:'CVE-2026-75077 XSS attempt on /BSCE2.php'"