CVE-2026-75078: Class and Exam Timetabling System XSS Flaw

CVE-2026-75078 Overview

CVE-2026-75078 is a reflected cross-site scripting (XSS) vulnerability in SourceCodester Class and Exam Timetabling System 1.0. The flaw resides in the /BSHRM1.php script, where the course parameter is rendered without proper output encoding. A remote attacker can craft a malicious URL that injects JavaScript into the response when a victim interacts with the link. Public exploit details have been released, increasing the likelihood of opportunistic abuse against exposed instances. The weakness is classified under CWE-79: Improper Neutralization of Input During Web Page Generation.

Critical Impact
Successful exploitation allows attackers to execute arbitrary JavaScript in a victim's browser session, enabling session theft, UI manipulation, and phishing against authenticated users of the timetabling application.

Affected Products

SourceCodester Class and Exam Timetabling System 1.0
The vulnerable component is the /BSHRM1.php endpoint
The unsafe input is the course request parameter

Discovery Timeline

2026-08-17 - CVE-2026-75078 published to the National Vulnerability Database (NVD)
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-75078

Vulnerability Analysis

The vulnerability is a reflected XSS issue in the /BSHRM1.php component of SourceCodester Class and Exam Timetabling System 1.0. The application accepts the course parameter from the client and includes its value in the generated HTML response without applying context-appropriate output encoding. Because user-controlled data is echoed directly into the page, an attacker can supply HTML or JavaScript payloads that the browser parses and executes. Exploitation requires user interaction, typically clicking a crafted link, but no authentication is needed. The impact is limited to integrity of the rendered page and any data accessible in the victim's browser context.

Root Cause

The root cause is missing input neutralization on the course parameter processed by /BSHRM1.php. The application does not sanitize or HTML-encode the value before writing it back to the response, violating standard secure output-handling practices described in CWE-79.

Attack Vector

A remote unauthenticated attacker delivers a URL containing a malicious course payload to a victim. When the victim visits the URL, the injected script executes in the origin of the vulnerable application. This can be used to steal session cookies, perform actions on behalf of authenticated users, or render deceptive content. The exploit has been publicly disclosed through the GitHub Issue Discussion and the VulDB Vulnerability Report, which lowers the barrier for opportunistic exploitation.

No verified exploit code is available for reproduction. See the referenced advisories for technical details on payload structure.

Detection Methods for CVE-2026-75078

Indicators of Compromise

HTTP GET or POST requests to /BSHRM1.php containing <script>, javascript:, onerror=, or onload= substrings in the course parameter
URL-encoded payload fragments such as %3Cscript%3E or %3Cimg targeting the course parameter
Referrer logs showing external redirects to /BSHRM1.php with unusually long course query strings

Detection Strategies

Inspect web server access logs for requests to /BSHRM1.php where the course parameter contains HTML control characters (<, >, ", ').
Deploy a web application firewall (WAF) rule that flags reflected XSS signatures on the course parameter.
Correlate outbound requests from browsers to attacker-controlled domains immediately after a user visits /BSHRM1.php.

Monitoring Recommendations

Enable verbose HTTP request logging on the web server hosting the timetabling application.
Forward web and proxy logs to a central analytics platform for pattern matching on XSS payloads.
Alert on repeated 200-response requests to /BSHRM1.php from the same source with varying course values, which may indicate payload fuzzing.

How to Mitigate CVE-2026-75078

Immediate Actions Required

Restrict public exposure of the Class and Exam Timetabling System until a patched build or code fix is applied.
Implement server-side input validation and HTML entity encoding on the course parameter in /BSHRM1.php.
Deploy WAF rules that block reflected XSS payloads targeting the vulnerable endpoint.
Notify users of the application to avoid clicking untrusted links referencing /BSHRM1.php.

Patch Information

No official vendor patch is referenced in the CVE record. Administrators should monitor the SourceCodester Blog and the VulDB CVE Details page for updates. Until a fix is published, apply source-level remediation by encoding the course value using PHP's htmlspecialchars($course, ENT_QUOTES | ENT_HTML5, 'UTF-8') before rendering.

Workarounds

Add a Content-Security-Policy response header that disallows inline scripts to reduce XSS impact.
Set session cookies with HttpOnly and SameSite=Strict attributes to limit session theft.
Apply virtual patching at the reverse proxy or WAF layer to strip HTML metacharacters from the course parameter.

bash

# Example ModSecurity rule to block reflected XSS on the course parameter
SecRule ARGS:course "@rx (?i)(<script|onerror=|onload=|javascript:)" \
    "id:1075078,phase:2,deny,status:403,log,msg:'CVE-2026-75078 XSS attempt on /BSHRM1.php'"