| 1 | Code Injection | high | contentScript2.js (line 4211) | Reads the JSON previously fetched from wadeh.net out of chrome.storage and concatenates it directly into the URL of a <script src> injected into the page's MAIN world. The bundled myscript2.js then executes in the pag… | |
| 2 | Code Injection | high | contentScript2.js (line 4211) | The content script injects `myscript2.js` into the page's main world with the previously-fetched wadeh.net JSON appended verbatim to `script.src` as a query parameter. The injected script (web-accessible) reads its ow… | |
| 3 | Code Injection | high | contentScript2.js (line 4211) | The previously cached wadeh.net response (`qqw`) is concatenated unsanitized into a query string and used as the `src` of an injected `<script>` tag pointing at the web-accessible `myscript2.js`. This gives the remote… | |
| 4 | Data Exfiltration | high | Sscript3.js (line 5534) | Teacher PII collected on the government portal is POSTed to tahdiri.com — a remote service the user has no relationship with from the host site's perspective. PII (email, name, phone) and authenticated school-portal l… | |
| 5 | Data Exfiltration | high | Sscript.js (line 3152) | School/teacher/student identifiers harvested from the host page (subject `mada`, class `saf`, teacher `molm`, school `mdrsa`, student list `tolab`) are concatenated into the query string of an anonymous Google Apps Sc… | |
| 6 | Obfuscation | high | contentScript2.js (line 1) | The entire contentScript2.js file is jQuery 3.6.1 source (see version literal 'al = "3.6.1"' on line 54) that has been deliberately rewritten with bracket-notation property access ('document', 'exports'), hex numeric … | |
| 7 | Remote Code Loading | high | contentScript2.js (line 54) | At top-level inside what is otherwise a verbatim jQuery 3.6.1 source file, the script issues an unconditional fetch to https://wadeh.net/ta1.php (a domain unrelated to the extension's stated service tahdiri.com) and p… | |
| 8 | Remote Code Loading | high | contentScript2.js (line 4211) | The previously-fetched payload from wadeh.net (stored as 'qqw') is appended verbatim to the URL of an injected page-context script (myscript2.js). The injected script runs in the MAIN world of every schools.madrasati.… | |
| 9 | Remote Code Loading | high | contentScript2.js (line 58) | At the top of the bundled jQuery file (running on every page under schools.madrasati.sa at document_start) the extension silently fetches data from an unrelated third-party domain wadeh.net (not the extension's own ta… | |
| 10 | Remote Code Loading | high | contentScript2.js (line 4211) | The data fetched from wadeh.net is read back from chrome.storage.local and concatenated unescaped into the src URL of a dynamically created <script> element pointing at the extension-bundled myscript2.js. The injected… | |
| 11 | Remote Code Loading | high | contentScript2.js (line 54) | Content script injected into all schools.madrasati.sa pages at document_start fetches JSON from a hard-coded third-party host wadeh.net (unrelated to the extension's stated Saudi education target sites and not adverti… | |
| 12 | Remote Code Loading | high | contentScript2.js (line 54) | A fetch to a third-party domain (`wadeh.net/ta1.php`) is hidden inside what is otherwise jQuery 3.6.1 source code. The retrieved JSON is persisted to `chrome.storage.local` under key `qqw` and later (line 4217-4219) a… | |
| 13 | Remote Code Loading | high | contentScript4.js (line 54) | Same hidden third-party-config pattern as in contentScript2.js, but using endpoint `wadeh.net/ta2.php` and storage key `qqws`. The retrieved data is later passed to `injectCode('/myscript4.js?a=' + qqws)` (line 4217-4… | |
| 14 | Remote Code Loading | high | contentScript2.js (line 54) | Content script (a bracket-notation/hex-obfuscated jQuery 3.6.1 build) silently fetches arbitrary JSON from `https://wadeh.net/ta1.php` and persists it to `chrome.storage.local` under key `qqw`. wadeh.net is not the ve… | |
| 15 | Remote Code Loading | high | contentScript2.js (line 58) | An unauthenticated GET request is issued to the third-party domain wadeh.net (unrelated to the extension's stated purpose of working with the Saudi schools.madrasati.sa site) and the JSON response is persisted into ch… | |
| 16 | Remote Code Loading | high | contentScript2.js (line 4211) | The data fetched from wadeh.net (cached in chrome.storage as 'qqw') is concatenated directly into the URL of a script tag injected into the host page (madrasati.sa). The injected script (myscript2.js) runs in page con… | |
| 17 | Unauthorized Data Collection | high | Sscript3.js (line 5484) | Silently scrapes the teacher's email, full legal name (first/middle/family) and mobile number (split on Saudi country code 966) from a fetched profile page on the Saudi government schools.madrasati.sa portal and store… | |
| 18 | Unauthorized Data Collection | high | Sscript.js (line 1847) | The script silently scrapes the teacher's full name (first/second/family), email, and Saudi mobile number from the Madrasati teacher profile page and stores them in localStorage. These values are then transmitted to `… | |
| 19 | Unauthorized Data Collection | high | Sscript.js (line 1847) | The extension scrapes the logged-in teacher's Microsoft/MoE email, full legal name (first+second+family) and Saudi mobile number (with country prefix 966 stripped) out of a madrasati.sa profile page and stores them in… | |
| 20 | Data Exfiltration | medium | Sscript3.js (line 6559) | Builds a navigation URL that places the teacher's email, full name, and phone number into the URL path of a third-party site. Putting PII in URL path segments leaks it into the third party's web-server access logs, an… | |
| 21 | Data Exfiltration | medium | Sscript3.js (line 5532) | While the user browses madrasati.sa, the content script POSTs the scraped teacher email to a third-party server (tahdiri.com) controlled by the extension developer. The same pattern is repeated in Sscript2.js (https:/… | |
| 22 | Data Exfiltration | medium | Sscript2.js (line 5469) | Sends the previously harvested teacher email together with curriculum selection IDs to tahdiri.com. Combined with the profile-scraping in Sscript3.js (name, phone, email), the developer's external server can correlate… | |
| 23 | Network Interception | medium | rule.json (line 1) | The declarativeNetRequest ruleset silently blocks a specific cookie-handling script (vstedu.azureedge.net/v19/scripts/jquery.cookie.js?v=12) loaded by the Saudi Ministry of Education's madrasati.sa portal. Suppressing… | |
| 24 | Network Interception | medium | rule.json (line 1) | declarativeNetRequest rule that blocks the host site's own jquery.cookie.js from loading on schools.madrasati.sa / external.madrasati.sa. Selectively neutering a script the host site relies on (cookie management) is a… | |
| 25 | Network Interception | medium | rule.json (line 1) | declarativeNetRequest rule blocks a specific cookie-handling script (`jquery.cookie.js`) loaded by the host madrasati.sa platform. Suppressing the host site's cookie helper while the extension simultaneously injects s… | |
| 26 | Network Interception | medium | rule.json (line 1) | The declarativeNetRequest ruleset blocks a specific third-party script (jquery.cookie.js served from a Microsoft Azure CDN) only when the user is on the madrasati.sa domains. Suppressing a legitimate first-party site'… | |
| 27 | Obfuscation | medium | contentScript2.js (line 58) | The remote command-and-config call is hidden inside a file that otherwise reproduces the standard jQuery 3.6.1 source (variable names a0..af, the jQuery init wrapper, etc.), making the malicious behavior easy to miss … | |
| 28 | Obfuscation | medium | contentScript2.js (line 1) | The contentScript2.js (4219 lines, injected on every schools.madrasati.sa page) is a copy of jQuery + base64 helpers heavily transformed with bracket-notation property access, hex numeric literals (0x0, 0x1), and \x20… | |
| 29 | Obfuscation | medium | contentScript2.js (line 1) | The bundled jQuery copy (also reused as contentScript2/4.js) is rewritten with bracket-only property access, hex numeric literals, and minimally-meaningful identifiers (`a0`, `cF`, `e4`) — patterns characteristic of l… | |
| 30 | Remote Code Loading | medium | Sscript2.js (line 5242) | Embedded SweetAlert2 v11.7.1 'protestware': if browser language starts with 'ru' and host TLD is .ru/.su/.xn--p1ai, after 3 days it disables pointer events on the page and loops an MP3 (Ukrainian anthem) from flag-gim… | |
| 31 | Tracking | medium | Sscript3.js (line 1) | On every page load matching the timetable URL, the extension polls localStorage and POSTs the user's email and a usage counter (`numbers`) to `tahdiri.com/api/user-request`. The use of synchronous AJAX (`async:!1`), a… | |
| 32 | Tracking | medium | Sscript3.js (line 1) | Background polling loop that reads the user's email from localStorage and POSTs it together with usage counters to `https://tahdiri.com/api/user-request`, then auto-closes the browser tab via `window.close()`. The com… | |
| 33 | Unauthorized Data Collection | medium | Sscript3.js (line 5483) | The extension silently fetches the teacher's profile page (/SystemUser/Home/UpdateMyInformation) and scrapes their Microsoft Teams email, full first/middle/family name, and Saudi mobile number (after stripping the +96… | |
| 34 | Obfuscation | low | contentScript2.js (line 1) | All property and method access in this content script is rewritten to bracketed string-literal form (chrome['storage']['local']['set'], cF['then'], document['createElement']('script')) and numeric literals are emitted… | |
| 35 | Other | low | Sscript.js (line 1491) | Embedded SweetAlert2 v11.7.1 contains the well-known protestware payload that, on Russian-language browsers visiting `.ru/.su/.xn--p1ai` hosts, disables all pointer events on `document.body` and loops an external MP3 … | |
| 36 | Privilege Escalation | low | Sscript2.js (line 6116) | The extension reads the page's anti-CSRF token (#csrfid / __RequestVerificationToken) and replays it on synchronous POSTs that create LearningResources, assignments, exams, and projects on the user's behalf. While tar… | |
| 37 | Unauthorized Data Collection | low | Sscript3.js (line 5927) | Teacher PII (email, full name, phone number) read from localStorage is concatenated directly into a URL path and used to navigate the user to tahdiri.com. Even though tahdiri.com is the extension's own backend (matchi… | |
