School Management System 1.0 — Reflected XSS in register.php (CVE-2026-37750)

Metadata

Affected Target

Summary

register.php in School Management System 1.0 reflects the type request parameter into the page’s HTML twice — once inside an <h1> tag via ucfirst($_REQUEST['type']) and once inside a form action attribute — without applying htmlspecialchars() or any output encoding. An unauthenticated attacker can craft a URL containing a <script> payload in the type parameter to execute arbitrary JavaScript in a victim’s browser when they open the link, enabling session-cookie theft, phishing, or malware redirection.

Vulnerability Details

Root Cause

Two sinks in register.php (echo ucfirst($_REQUEST['type']) and echo $_REQUEST['type'] inside a form action) output raw, unescaped user input directly into HTML (CWE-79).

Attack Vector

1. Craft a URL such as http://target/register.php?type=<script>alert(document.cookie)</script>.
2. Send or embed the URL for a victim to click (no authentication required).
3. When the victim’s browser loads the page, the injected script executes in the victim’s session context.
4. Use the payload to exfiltrate cookies, inject phishing forms, or redirect to attacker-controlled infrastructure.

Impact

Session hijacking via cookie theft, credential phishing, and malicious redirects — all without requiring authentication.

Environment / Lab Setup

Target:   School Management System 1.0 (PHP)
Attacker: Python 3, requests library / any web browser

Proof of Concept

PoC Script

See exploit.py in this folder.

1

python3 exploit.py -u http://target/register.php

The script sends the crafted type parameter payload against register.php and verifies that the injected script tag is reflected unescaped in the response.

Detection & Indicators of Compromise

GET /register.php?type=%3Cscript%3E... HTTP/1.1

Signs of compromise:

• Requests to register.php with <script>, onerror=, or other HTML/JS metacharacters in the type parameter
• Reports of unexpected pop-ups, redirects, or credential prompts from users visiting the registration page

Remediation

References

• Source repository

Notes

Mirrored from https://github.com/menevarad007/CVE-2026-37750 on 2026-07-05.