Description

A vulnerability was determined in projectworlds Online Examination System 1.0. The affected element is an unknown function of the file feedback.php of the component Feedback Form. Executing a manipulation of the argument Name/Subject can lead to cross site scripting. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-09-07T01:16:56.223Z",
  "pubdate": "2026-09-07T01:16:56.223Z",
  "executiveSummary": "A reflected cross-site scripting (XSS) vulnerability exists within the feedback.php file of the projectworlds Online Examination System 1.0.\nThe vulnerability originates from improper input validation of the 'Name' and 'Subject' parameters within the feedback form component.\nSuccessful exploitation allows remote, unauthenticated attackers to execute arbitrary JavaScript in the context of a victim's browser session.\nThis vulnerability poses a significant risk, as it can be leveraged to hijack user sessions, perform unauthorized actions on behalf of the user, or exfiltrate sensitive data.\nThe vulnerability is currently publicly disclosed, increasing the likelihood of exploitation by threat actors.\nRemediation requires the implementation of robust input sanitization and context-aware output encoding to neutralize malicious payloads.",
  "technicalDetails": "The vulnerability is categorized as a Reflected Cross-Site Scripting (XSS) flaw, residing in the feedback processing logic of the projectworlds Online Examination System 1.0.\nThe root cause is the application's failure to sanitize user-supplied input provided via the 'Name' or 'Subject' parameters before reflecting that data back to the user within the HTML response generated by feedback.php.\nBecause the application does not implement adequate output encoding, an attacker can supply a malicious string containing executable JavaScript (e.g., <script>alert(document.cookie)</script>) in these parameters.\nWhen a user interacts with a specially crafted URL or form submission containing this malicious payload, the application processes the input and includes the unencoded script in the subsequent HTTP response.\nThe victim's web browser interprets the reflected payload as valid client-side code, executing it within the security context of the vulnerable application's origin.\nThis execution happens remotely and does not strictly require authenticated access, as the vulnerability is triggered by the application's reflection mechanism.\nThe attack flow follows a predictable pattern: 1) An attacker crafts a malicious input string containing JavaScript; 2) The input is submitted through the feedback form fields 'Name' or 'Subject'; 3) The server-side script, feedback.php, receives this input and echoes it directly back to the user's browser without escaping special characters like angle brackets (<, >) or quotes (', \"); 4) The victim's browser parses the HTTP response and executes the injected script.\nPost-exploitation impact includes the ability to perform session hijacking by accessing the victim's session tokens via document.cookie, redirecting the user to malicious external sites, performing unauthorized requests on behalf of the user, or deploying sophisticated browser-based keyloggers to capture sensitive credentials as they are typed."
}