Cross-site scripting in SourceCodester Class and Exam Timetabling System

A security vulnerability has been detected in SourceCodester Class and Exam Timetabling System 1.0. This affects an unknown part of the file /subject1.php. Such manipulation of the argument subject leads to cross site scripting. The attack can be executed remotely. The exploit has been disclosed publicly and may be used.

• SourceCodester Class and Exam Timetabling System 1.0: affected.
• The component identified in the record is /subject1.php, with the subject argument as the relevant input.
• No additional release branches are confirmed by the supplied evidence.
• No fixed release or exact remediation boundary is identified.

The vulnerability is in the handling of attacker-controlled data in the subject argument of /subject1.php. The record confirms that manipulating this argument leads to cross-site scripting, but it does not identify the specific implementation part or sink responsible. It is therefore not established whether the issue is reflected or stored XSS, which HTTP method is involved, which HTML context is affected, or what encoding control is missing. The supplied attack characteristics indicate network reachability, no authentication requirement, and low complexity, with user interaction required or passive. The likely result is script execution in a victim's browser and modification of browser-side content or actions, but the exact outcome depends on the undisclosed rendering context.

• The issue is remotely reachable over a network.
• The supplied attack characteristics indicate that authentication is not required and complexity is low.
• User interaction is marked as required or passive; the exact victim action is not documented.
• A public exploit has been disclosed and may be used. The record does not name a campaign, victim, or specific environment where exploitation occurred.

A successful attack could modify content or trigger actions in a user's browser through cross-site scripting. The record describes low integrity impact and does not indicate confidentiality or availability impact. The supplied scope characteristics do not indicate automatic propagation to another component, but the actual consequence depends on the victim's privileges and the context in which subject is rendered. There is insufficient evidence to conclude that the issue causes server compromise, data disclosure, or account takeover.

• User-visible class or exam timetable content could be modified in the browser, causing confusion or reducing trust in the application.
• Malicious script could perform actions in the victim's browser context, depending on the privileges and functions available to that user.
• The supplied characteristics indicate a primary low-integrity impact; the record does not establish direct confidentiality loss or service disruption.
• The practical consequence depends on the rendering context for subject and the types of users who can view the affected content.

1. Confirm every SourceCodester Class and Exam Timetabling System 1.0 deployment and prioritize instances reachable from untrusted networks.
2. Contact or monitor SourceCodester for an official correction; the record does not provide a fixed release.
3. Until a correction is available, review and correct the subject handling path with appropriate input validation and context-specific output encoding before the value is placed in HTML.
4. If operationally appropriate, restrict network access to /subject1.php or temporarily disable the related function after assessing business impact. This is temporary exposure reduction, not evidence of a patch.

1. Inventory deployments of SourceCodester Class and Exam Timetabling System and identify the version of each installation.
2. Check whether /subject1.php is reachable from untrusted networks and locate where the subject argument is processed in application code or templates.
3. Review whether subject receives context-appropriate output encoding before it is placed into HTML or a response. Approved testing in a non-production environment can be used to validate the behavior.
4. Review access logs for /subject1.php and requests containing the subject parameter. Values containing markup or script-like content should be treated as investigation leads, not as vendor-confirmed indicators.