A Reflected Cross-site Scripting vulnerability in Proliz Software OBS allows unauthenticated attackers to execute malicious scripts in the context of a user session.

This is a Reflected Cross-site Scripting (CWE-79) flaw. An unauthenticated attacker can supply malicious input that is reflected back to the victim, potentially leading to unauthorized actions or sensitive data disclosure.

Successful exploitation allows an attacker to execute arbitrary scripts in the browser of an unsuspecting user, potentially leading to session hijacking, credential theft, or unauthorized modifications to sensitive student data. With a CVSS score of 7.6, this vulnerability represents a significant risk to the integrity and confidentiality of the student information system.

Immediate Action: Update the Proliz Software OBS system to version V26.0401 or later to resolve the underlying input validation flaw.

Proactive Monitoring: Review web server and application logs for suspicious URL parameters containing script tags or encoded characters that deviate from expected input patterns.

Compensating Controls: Implement a strict Content Security Policy (CSP) and deploy a Web Application Firewall (WAF) with rules configured to detect and block malicious script injection attempts.

Public Exploit Available: No (exploit_available: false).

Organizations utilizing Proliz Software OBS must prioritize the application of the vendor update to version V26.0401. Given the potential for session compromise, security teams should treat this as a high-priority item and ensure that all web-facing instances are patched or protected behind robust WAF rules to prevent exploitation.