CVE-2026-78055: Class and Exam Timetabling System XSS Flaw

CVE-2026-78055 Overview

CVE-2026-78055 is a reflected cross-site scripting (XSS) vulnerability in SourceCodester Class and Exam Timetabling System 1.0. The flaw resides in the /BSIT2.php file, where the course parameter is not properly sanitized before being rendered in HTTP responses. Remote attackers can inject malicious script content that executes in the browser context of any user who follows a crafted link. The exploit has been publicly disclosed, increasing the likelihood of opportunistic abuse. The vulnerability is tracked under CWE-79 and requires user interaction to succeed.

Critical Impact
Successful exploitation allows attackers to execute arbitrary JavaScript in victim browsers, enabling session theft, credential harvesting, and unauthorized actions performed as the authenticated user.

Affected Products

SourceCodester Class and Exam Timetabling System 1.0
Deployments exposing /BSIT2.php to untrusted networks
Environments using default installations without input filtering middleware

Discovery Timeline

2026-08-23 - CVE-2026-78055 published to NVD
2026-08-24 - Last updated in NVD database

Technical Details for CVE-2026-78055

Vulnerability Analysis

The vulnerability is a reflected cross-site scripting flaw in the Class and Exam Timetabling System. The /BSIT2.php endpoint accepts a course argument through HTTP request parameters. The application echoes this value directly into the generated HTML response without applying output encoding or input validation. Attackers who craft a URL containing script payloads in the course parameter can trigger execution when a victim visits the link. Because exploitation runs in the browser under the application's origin, attackers gain access to same-origin resources including cookies, DOM content, and any authenticated session state.

Root Cause

The root cause is missing output encoding on user-supplied input reflected into HTML. The course parameter flows from the HTTP request into the response body without HTML entity escaping, sanitization, or context-aware encoding. This aligns with CWE-79: Improper Neutralization of Input During Web Page Generation.

Attack Vector

Exploitation is remote and requires user interaction. An attacker constructs a URL to /BSIT2.php with a malicious payload in the course query parameter and delivers it through phishing, forum posts, or third-party sites. When a logged-in user opens the link, the injected script runs in the context of the vulnerable application. The attacker can exfiltrate session cookies, manipulate rendered content, redirect users, or perform actions on behalf of the victim within the timetabling system.

See the GitHub Issue Tracker and the VulDB Vulnerability Detail for further technical context.

Detection Methods for CVE-2026-78055

Indicators of Compromise

HTTP requests to /BSIT2.php containing angle brackets, script tags, or JavaScript URI schemes in the course parameter
Web server access logs showing URL-encoded payloads such as %3Cscript%3E or javascript: in query strings
Unusual outbound requests from user browsers to attacker-controlled domains shortly after visiting timetabling URLs

Detection Strategies

Deploy a web application firewall with rules that inspect query parameters for XSS signatures targeting /BSIT2.php
Correlate suspicious referrer chains where users arrive at /BSIT2.php from external domains carrying encoded script content
Review PHP application logs for anomalous course parameter values that deviate from expected course identifier formats

Monitoring Recommendations

Enable verbose HTTP request logging on the web server hosting the timetabling system and forward logs to a central analytics platform
Alert on repeated failed input validation events or WAF blocks targeting the affected endpoint
Monitor authenticated user sessions for concurrent geolocations or unexpected privilege actions that suggest session hijacking

How to Mitigate CVE-2026-78055

Immediate Actions Required

Restrict access to /BSIT2.php behind authenticated networks or VPN until a fix is applied
Deploy WAF rules that block requests containing HTML or script metacharacters in the course parameter
Instruct users to avoid clicking timetabling links received from untrusted sources

Patch Information

No vendor patch is currently referenced in the NVD entry for CVE-2026-78055. Administrators should monitor the SourceCodester Resource Hub and the VulDB CVE Entry for updates. Until an official fix is released, apply compensating controls at the web server or application layer.

Workarounds

Add server-side input validation to reject any course value that does not match an expected allowlist pattern such as alphanumeric course codes
Apply HTML entity encoding to all reflected parameters using PHP htmlspecialchars() with the ENT_QUOTES flag and UTF-8 charset
Set a strict Content Security Policy header disallowing inline scripts and untrusted script sources to reduce XSS impact
Configure session cookies with HttpOnly and SameSite=Strict attributes to limit theft through injected scripts

bash

# Example Apache configuration adding a Content Security Policy header
Header always set Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'"
Header always set X-XSS-Protection "1; mode=block"
Header always set X-Content-Type-Options "nosniff"