The failure in the echo function of admin/fun/addLog.php allows an attacker to inject arbitrary JavaScript by manipulating the reason/detail argument. Based on the description, it is inferred that no authentication is required, so any remote user can craft a request that will cause the script to execute in the browser of anyone who views the affected page. The injected code can hijack sessions, steal credentials, or deface content, demonstrating a classic cross‑site scripting flaw (CWE‑79) and potential for code injection (CWE‑94).

The flaw affects installations of ningzichun student‑management‑system that use any codebase up to commit 98760f5711cf6dc8b4adca53a9e207ca49b02ebf. No patched release is currently available, and the project has not responded to the disclosed issue, leaving all such installations exposed.

The CVSS score of 5.3 indicates moderate severity. EPSS information is not available and the vulnerability is not listed in the CISA KEV catalog, yet the public disclosure and the remote nature of the attack suggest a non‑negligible exploitation probability. An attacker only needs to send a crafted HTTP request to the vulnerable endpoint; once executed, any user who loads the resulting page will be vulnerable to the injected script.