CVE-2026-90615 Overview
CVE-2026-90615 is a reflected cross-site scripting (XSS) vulnerability in SourceCodester Class and Exam Timetabling System 1.0. The flaw resides in the /subject1.php file, where the subject parameter is not properly sanitized before being rendered in the response. Remote attackers can craft a malicious URL that, when visited by a user, executes arbitrary JavaScript in the victim's browser session. The vulnerability has been publicly disclosed, and proof-of-concept details are available through third-party trackers. It is categorized under [CWE-79] (Improper Neutralization of Input During Web Page Generation).
Critical Impact
Successful exploitation allows attackers to hijack sessions, redirect users, or perform actions in the context of an authenticated user of the timetabling application.
Affected Products
- SourceCodester Class and Exam Timetabling System 1.0
- Component: /subject1.php
- Vulnerable parameter: subject
Discovery Timeline
- 2026-09-14 - CVE-2026-90615 published to NVD
- 2026-09-15 - Last updated in NVD database
Technical Details for CVE-2026-90615
Vulnerability Analysis
The vulnerability is a reflected XSS flaw in the /subject1.php endpoint of the Class and Exam Timetabling System. User-controlled input supplied through the subject request parameter is echoed back into the HTML response without adequate encoding or filtering. An attacker can inject arbitrary script content that executes in the browser of any user who follows a crafted link. Exploitation requires user interaction, which aligns with the CVSS 4.0 vector indicating UI:P (passive user interaction).
Because the target application manages academic scheduling data, XSS payloads can be used to steal session cookies, tamper with timetable content, or pivot into administrative functions where authenticated privileges exist.
Root Cause
The root cause is missing output encoding and input validation on the subject parameter processed by /subject1.php. The application inserts the parameter value directly into the rendered HTML, allowing HTML and JavaScript control characters such as <, >, and " to break out of the expected data context and enter an executable script context.
Attack Vector
The attack is executed remotely over the network without authentication. An attacker crafts a URL containing a JavaScript payload in the subject parameter and delivers it through phishing, social engineering, or embedded links on attacker-controlled pages. When a user with an active session opens the link, the injected script runs under the origin of the vulnerable application.
No verified exploit code is published for this CVE. The vulnerability mechanism follows the standard reflected XSS pattern: unsanitized query parameters returned in the HTTP response body. Refer to the GitHub Issue Discussion and VulDB CVE Details for additional technical context.
Detection Methods for CVE-2026-90615
Indicators of Compromise
- HTTP requests to /subject1.php containing <script>, javascript:, onerror=, or URL-encoded equivalents in the subject parameter.
- Web server access logs showing anomalously long or malformed subject query strings originating from unfamiliar user agents or referrers.
- Unexpected outbound requests from user browsers to attacker-controlled domains shortly after visiting the application.
Detection Strategies
- Deploy a Web Application Firewall (WAF) rule set that inspects the subject parameter for HTML and JavaScript metacharacters.
- Enable server-side request logging on /subject1.php and alert on payloads that match known XSS signatures such as <script, onerror=, or document.cookie.
- Perform authenticated dynamic application security testing (DAST) against the endpoint to confirm reflection behavior.
Monitoring Recommendations
- Monitor browser telemetry for Content Security Policy (CSP) violation reports from the application origin.
- Correlate abnormal session behavior, such as sudden privilege changes or unexpected form submissions, with recent access to /subject1.php.
- Track referrer headers pointing to external sites when users land on /subject1.php with query parameters.
How to Mitigate CVE-2026-90615
Immediate Actions Required
- Restrict public access to the Class and Exam Timetabling System until a fix is applied, using network-level controls or authentication gateways.
- Deploy WAF rules that block requests to /subject1.php containing script tags, event handlers, or encoded JavaScript URIs in the subject parameter.
- Notify users of the application about the risk of following untrusted links to the affected system.
Patch Information
No official vendor patch is referenced in the CVE record at the time of publication. SourceCodester project maintainers have not published a fixed release for this issue. Administrators should monitor the SourceCodester Resources site and the GitHub Issue Discussion for updates.
Workarounds
- Modify /subject1.php to apply context-appropriate output encoding, for example using htmlspecialchars($_GET['subject'], ENT_QUOTES, 'UTF-8') before rendering the value.
- Implement a strict Content Security Policy that disallows inline scripts and restricts script sources to trusted origins.
- Add server-side input validation that rejects subject values containing characters outside an allowlist appropriate for subject names.
- Consider decommissioning the application if it is not actively maintained and no vendor patch becomes available.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
