Affected Component

File: PersonalAGS/index.php?action=register (Student Registration)
Parameters: student_id, full_name, section, username (POST)
Triggered on: PersonalAGS/index.php?action=dashboard (Admin Dashboard)

Description

The student self-registration portal in CET Automated Grading System 1.0 fails to sanitize or encode user-supplied input before storing it in the database. An unauthenticated attacker can register a student account with JavaScript payloads injected into any registration field. The malicious payload is stored in the database and executes in the browser of any administrator who visits the dashboard where enrolled students are listed.

This is a critical attack chain — no authentication is required to inject the payload, but it executes in a privileged admin context, enabling session cookie theft and full admin account takeover.

Proof of Concept

Step 1 — Navigate to Student Registration (No Auth Required)

Navigate to the public student self-registration page:

Step 2 — Inject XSS Payload in Registration Fields

Fill in all fields with XSS payloads and click Register Account:

• Student ID Number: "><svg onload=alert(1)>
• Full Name: "><svg onload=alert(1)>
• Section: "><svg onload=alert(1)>
• Desired Username: "><svg onload=alert(1)>

Registration succeeds — the payloads are stored in the database.

Step 3 — XSS Fires on Admin Dashboard

When the administrator logs in and visits the dashboard, the injected payload executes immediately. The alert popup fires and the page layout is visibly broken by the injected HTML — confirming the payload is rendered unsanitized in the admin panel.

The dashboard section headers also reflect the injected values:

• 1ST YEAR - SECTION 1ST YEAR" ONMOUSEOVE
• 3RD YEAR - SECTION " ONLOAD=ALERT(1) X=

Session Hijacking Payload

An attacker can escalate this to full admin session hijacking by using the following payload in the registration fields:

Set up a listener on the attacker machine:

When the admin visits the dashboard, their session cookie is sent to the attacker's server, enabling complete account takeover.

Impact

An unauthenticated attacker can:

• Inject persistent JavaScript into the admin dashboard via public student registration
• Steal the administrator's session cookie and take over the admin account
• Perform any admin action on behalf of the victim
• Redirect administrators to malicious pages
• Deface the admin dashboard

No authentication is required to inject the payload. The attack executes automatically when any administrator visits the dashboard.

References

• SourceCodester — CET Automated Grading System
• CWE-79: Improper Neutralization of Input During Web Page Generation.