Code-Projects Online Examination System Cross-Site Scripting Vulnerability

A reflected cross-site scripting vulnerability has been identified in Code-Projects Online Examination System version 1.0. The issue arises in the file account.php when the quiz page is accessed with specific URL parameters. The application fails to properly sanitize user input, allowing attackers to inject malicious scripts that are executed in the context of the user's browser session.

Impact

Exploitation of this vulnerability allows for the execution of arbitrary JavaScript in the context of the authenticated user, potentially leading to session hijacking, data theft, manipulation of page content, phishing attacks, or unauthorized actions on behalf of the user.

Reproduction

To reproduce this vulnerability, log into the application as a student and navigate to the quiz page. The vulnerability can be triggered by sending a GET request to account.php with the q, step, eid, n, and t parameters. The n parameter should be injected with a script payload, such as a JavaScript alert. The lack of output encoding in the form action attribute allows the injected script to be executed in the user's browser.