Session-cookie theft via unsanitized admission fields

Stored XSS in QDOCS Smart School 7.0 allows remote authenticated users to steal session cookies via crafted admission submissions. The /online_admission handler accepts firstname, lastname, guardian_name, and other POST fields without proper validation, allowing stored content to execute in a later visitor's browser. Exploitation requires low-privileged access and a separate authenticated user to view the stored content; the documented consequence is disclosure of that user's session cookie.