University Management System EUVD-2026-12706

While the CVSS v3.1 score of 2.4 is notably low, the risk assessment reveals important nuances. The attack vector is Network-based (AV:N) with Low complexity (AC:L), making exploitation straightforward, but requires High privilege level (PR:H) and user interaction (UI:R), which significantly restricts the threat landscape. The vulnerability affects only authenticated high-privilege users who must trick another user into visiting a malicious link—limiting the practical exploitation pool in typical university environments. However, the existence of a public proof-of-concept on GitHub elevates real-world risk beyond the CVSS score alone. The impact is limited to Integrity (I:L) with no Confidentiality or Availability impact, meaning an attacker cannot exfiltrate data or disable the system. SSVC analysis confirms this is exploitable but requires significant user interaction and elevated credentials, making it a lower-priority issue compared to unauthenticated or pre-auth vulnerabilities. Priority should reflect the specific deployment context: isolated internal university systems face lower risk than internet-facing instances.

An authenticated administrator receives a phishing email or visits a malicious website containing a crafted URL pointing to the vulnerable /add_result.php file with a payload injected into the 'vr' parameter, such as /add_result.php?vr=<script>steal_session()</script>. When the administrator clicks the link, the unencoded JavaScript executes in their browser, allowing the attacker to capture their session cookie or perform unauthorized actions (such as modifying student grades) on their behalf. The public proof-of-concept available on GitHub (https://github.com/sulvant/Security/issues/2) demonstrates this attack pattern, lowering the technical barrier for potential threat actors.