CVE-2026-78054: Class and Exam Timetabling System XSS Flaw

CVE-2026-78054 Overview

CVE-2026-78054 is a reflected cross-site scripting (XSS) vulnerability in SourceCodester Class and Exam Timetabling System 1.0. The flaw resides in the /BSIS1.php endpoint, where the course argument is rendered without proper output encoding. Remote attackers can craft a malicious link that executes arbitrary JavaScript in the victim's browser session when the user interacts with it. The vulnerability is classified under CWE-79 and requires user interaction for successful exploitation. A public exploit is referenced in the vulnerability disclosures, increasing the likelihood of opportunistic abuse against exposed instances.

Critical Impact
Successful exploitation allows an attacker to execute arbitrary script in the browser of an authenticated user, enabling session data theft, unauthorized actions, and phishing pivots within the affected timetabling application.

Affected Products

SourceCodester Class and Exam Timetabling System 1.0
Deployments exposing the vulnerable /BSIS1.php endpoint
Environments where the course request parameter is reflected without sanitization

Discovery Timeline

2026-08-23 - CVE-2026-78054 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-78054

Vulnerability Analysis

The vulnerability is a reflected cross-site scripting (XSS) issue in the /BSIS1.php script of SourceCodester Class and Exam Timetabling System 1.0. User-supplied input to the course parameter is written to the HTTP response without contextual output encoding. An attacker who convinces a user to follow a crafted URL can trigger execution of arbitrary JavaScript in the victim's browser under the origin of the affected application.

Because the payload executes in the context of an authenticated session, an attacker can read the DOM, exfiltrate session cookies not protected by HttpOnly, submit requests on the victim's behalf, or render deceptive content to harvest credentials. The scope is limited to browser-side impact; the underlying server is not directly compromised through this flaw alone. Exploitation requires only network reachability to the application and a single click by a targeted user.

Root Cause

The root cause is missing output encoding on data flowing from the course HTTP parameter into an HTML response context. The application concatenates untrusted input into markup without escaping characters such as <, >, ", and '. This directly matches the classic pattern described by CWE-79: Improper Neutralization of Input During Web Page Generation.

Attack Vector

The attack is delivered remotely over the network. An attacker crafts a URL to /BSIS1.php with a JavaScript payload embedded in the course parameter and delivers it through phishing, chat, or third-party sites. When a logged-in user opens the link, the reflected payload executes inside the application origin. Additional details are documented in the GitHub Issue Discussion and the VulDB Vulnerability Detail.

No verified code examples are available for this CVE. The vulnerability mechanism is described in prose above; consult the referenced advisories for reproduction specifics.

Detection Methods for CVE-2026-78054

Indicators of Compromise

HTTP requests to /BSIS1.php containing the course parameter with <script>, onerror=, onload=, javascript:, or URL-encoded equivalents such as %3Cscript%3E.
Referrer headers from unexpected external domains preceding requests to /BSIS1.php.
Web server access logs showing abnormally long or entity-encoded values for the course argument.

Detection Strategies

Deploy web application firewall (WAF) signatures that inspect query and body parameters for reflected XSS payloads targeting the course field.
Correlate outbound browser telemetry with inbound reflected content to identify script execution originating from parameter reflection.
Review historical logs for the /BSIS1.php path to identify prior probing that may indicate reconnaissance.

Monitoring Recommendations

Alert on any request to /BSIS1.php whose parameters contain HTML tag delimiters or JavaScript event handlers.
Monitor authenticated sessions for anomalous DOM interactions, unexpected cookie access, or requests originating shortly after clicking external links.
Enable Content Security Policy (CSP) violation reporting to surface blocked inline script execution attempts.

How to Mitigate CVE-2026-78054

Immediate Actions Required

Restrict external exposure of the Class and Exam Timetabling System until a fix is applied; place the application behind authenticated access controls or a VPN.
Deploy a WAF rule to block requests to /BSIS1.php where the course parameter contains HTML or JavaScript metacharacters.
Instruct users to avoid clicking untrusted links referencing the application and to log out when the system is not in use.

Patch Information

No vendor patch is referenced in the available advisories at the time of publication. Track the VulDB CVE Overview and SourceCodester Security Resources for remediation updates. Until a vendor fix is issued, apply the source-level hardening described below.

Workarounds

Modify /BSIS1.php to apply context-appropriate output encoding on the course parameter using htmlspecialchars($course, ENT_QUOTES | ENT_HTML5, 'UTF-8') before rendering.
Add an allowlist-based input validator that restricts course to expected alphanumeric characters and rejects any request containing <, >, ", or '.
Enforce a strict Content Security Policy that disallows inline scripts and limits script sources to trusted origins.
Set the HttpOnly and SameSite=Strict attributes on session cookies to reduce session theft impact if a payload executes.

bash

# Example Apache mod_security rule to block reflected XSS attempts on /BSIS1.php
SecRule REQUEST_URI "@beginsWith /BSIS1.php" \
  "chain,id:1078054,phase:2,deny,status:403,log,msg:'CVE-2026-78054 XSS attempt on course parameter'"
  SecRule ARGS:course "@rx (?i)(<script|onerror=|onload=|javascript:|%3Cscript)" "t:none,t:urlDecodeUni"