This vulnerability in ningzichun student-management-system up to commit 98760f5711cf6dc8b4adca53a9e207ca49b02ebf allows remote attackers to perform cross-site scripting via the reason/detail parameter in the echo function of admin/fun/addLog.php. The vulnerability is due to insufficient input sanitization, enabling injection of malicious scripts. The project was informed early but has not issued a response or patch. Exploit code has been publicly disclosed.

Successful exploitation allows attackers to execute arbitrary scripts in the context of the affected web application, potentially leading to session hijacking, defacement, or other malicious actions within the user's browser session. The vulnerability requires no privileges and no user interaction other than visiting a crafted URL or page. However, it does not involve confidentiality or integrity violations beyond script execution in the client context.

No official fix or patch is currently available as the vendor has not responded. Users should apply standard XSS mitigations such as input validation and output encoding on the reason/detail parameter if possible. Monitor the vendor's advisory channels for updates and patches. Until a fix is released, consider restricting access to the vulnerable functionality or employing web application firewalls to detect and block XSS payloads.