CVE-2025-29568
📋 TL;DR
This vulnerability in code-projects Online Class and Exam Scheduling System 1.0 allows attackers to inject malicious scripts via the class parameter in /Scheduling/pages/class_sched.php. When exploited, this cross-site scripting (XSS) vulnerability can enable session hijacking, phishing attacks, or website defacement. Organizations using this specific version of the scheduling system are affected.
💻 Affected Systems
- code-projects Online Class and Exam Scheduling System
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers could steal administrator credentials, hijack user sessions, redirect users to malicious sites, or completely compromise the scheduling system's functionality.
Likely Case
Attackers inject malicious scripts to steal user session cookies, perform phishing attacks, or deface the scheduling interface.
If Mitigated
With proper input validation and output encoding, the impact is limited to unsuccessful script injection attempts.
🎯 Exploit Status
The vulnerability is simple to exploit by manipulating URL parameters, and proof-of-concept details are publicly available.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None available
Restart Required: No
Instructions:
No official patch available. Implement input validation and output encoding in /Scheduling/pages/class_sched.php to sanitize the class parameter.
🔧 Temporary Workarounds
Web Application Firewall (WAF) Rules
allDeploy WAF rules to block XSS payloads targeting the class parameter
Input Validation Filter
allAdd server-side validation to reject malicious input in class parameter
🧯 If You Can't Patch
- Implement Content Security Policy (CSP) headers to restrict script execution
- Restrict access to the scheduling system to trusted networks only
🔍 How to Verify
Check if Vulnerable:
Test by injecting XSS payloads into the class parameter of /Scheduling/pages/class_sched.php and checking if scripts executeCheck Version:
Check system documentation or configuration files for version informationVerify Fix Applied:
Verify that XSS payloads in the class parameter are properly sanitized and do not execute📡 Detection & Monitoring
Log Indicators:
- Unusual parameter values in class_sched.php requests
- Script tags or JavaScript in URL parameters
Network Indicators:
- HTTP requests with suspicious payloads in class parameter
- Multiple failed XSS attempts
SIEM Query:
source="web_server" AND (url="*class_sched.php*" AND (param="*<script>*" OR param="*javascript:*"))