Description

A vulnerability has been found in code-projects Assessment Management 1.0. This impacts an unknown function of the file admin/edit-user.php of the component User Editing. The manipulation of the argument name/sname/email/username/password/id leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "2.4",
  "pubDate": "2026-09-20T10:16:52.990Z",
  "pubdate": "2026-09-20T10:16:52.990Z",
  "executiveSummary": "A Cross-Site Scripting (XSS) vulnerability exists in the Assessment Management 1.0 'User Editing' component.\nThe vulnerability resides within the admin/edit-user.php file, where improper neutralization of user-supplied input allows for the injection of malicious scripts.\nSuccessful exploitation permits an unauthenticated or authenticated remote attacker to execute arbitrary JavaScript in the victim's browser session.\nThis can lead to session hijacking, unauthorized actions on behalf of the administrator, data exfiltration, and the modification of user account details.\nThe flaw stems from a lack of server-side input validation and output encoding on several fields, including name, sname, email, username, password, and id.\nThe public disclosure of this exploit increases the risk of targeted attacks against administrators using the affected software.\nImmediate remediation is required to prevent credential compromise and system-wide unauthorized access.",
  "technicalDetails": "The vulnerability is identified as a Stored or Reflected Cross-Site Scripting (XSS) flaw located within the admin/edit-user.php file of the Assessment Management 1.0 application.\nThe root cause is the failure of the application to properly sanitize and validate the input parameters: 'name', 'sname', 'email', 'username', 'password', and 'id'. These arguments are processed and subsequently reflected back into the browser's Document Object Model (DOM) without adequate contextual output encoding.\nThe attack flow begins when an attacker identifies the input fields within the user modification interface. By injecting malicious payload strings, such as <script>alert(document.cookie)</script>, into one of the vulnerable arguments, the attacker forces the application to store or reflect the payload within the administrative interface.\nWhen an administrator accesses the compromised user profile page, the injected JavaScript executes within the security context of the administrative session. Because the script executes in the victim's browser, it inherits the administrator's session privileges, enabling the attacker to perform actions that are otherwise restricted to authorized users.\nExploitation is possible remotely and does not strictly require complex infrastructure, making it a highly accessible vector for malicious actors. The impact is significant, as it allows for the theft of sensitive session cookies, bypassing CSRF protections, or altering administrative records to gain persistent back-door access to the Assessment Management platform.\nThe technical failure involves a lack of implementation for character entity encoding (e.g., converting '<' to '&lt;' and '>' to '&gt;') and missing server-side input validation, which allows the browser to interpret user-supplied input as executable markup or script content rather than plain text data.\nGiven that this vulnerability has been disclosed publicly, the threshold for exploitation is low, and the risk of automated scanning and manual exploitation against active deployments is elevated."
}