Description

A vulnerability was found in code-projects Assessment Management 1.0. Affected is an unknown function of the file admin/add-user.php. The manipulation of the argument level results in cross site scripting. The attack may be launched remotely. The exploit has been made public and could be used.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "2.4",
  "pubDate": "2026-09-20T10:16:53.280Z",
  "pubdate": "2026-09-20T10:16:53.280Z",
  "executiveSummary": "A Reflected Cross-Site Scripting (XSS) vulnerability exists within the 'admin/add-user.php' component of the 'code-projects Assessment Management 1.0' application.\nThe vulnerability originates from the application's failure to adequately sanitize or encode user-supplied input provided via the 'level' argument before rendering it within the HTML response.\nThis flaw allows a remote, unauthenticated or authenticated attacker to inject and execute arbitrary JavaScript code in the context of the victim's browser session.\nSuccessful exploitation can lead to session hijacking, unauthorized actions performed on behalf of the administrator, redirection to malicious domains, or the exfiltration of sensitive information such as cookies and session tokens.\nThe exploit for this vulnerability is currently public, significantly increasing the risk of active exploitation by malicious actors.\nImmediate mitigation is required to prevent compromise of administrative accounts and subsequent unauthorized access to the application's backend infrastructure.",
  "technicalDetails": "The vulnerability is a classic Reflected Cross-Site Scripting (XSS) flaw located in the 'admin/add-user.php' file. The root cause is improper neutralization of input within the 'level' parameter, which is processed by the server and reflected back to the client-side browser without sufficient security controls such as context-aware output encoding or strict input validation.\nIn the standard attack flow, an attacker crafts a malicious URL containing a crafted JavaScript payload embedded within the 'level' query parameter or POST body. When an administrator or privileged user clicks the link or visits the manipulated page, the application processes the 'level' argument and includes the malicious script directly into the HTML document's Document Object Model (DOM).\nOnce the page is rendered in the victim's browser, the malicious script executes within the security context of the origin where the application resides. Because the vulnerability exists within an administrative file ('admin/add-user.php'), the impact is severe; the attacker can perform actions that are restricted to administrative accounts, potentially leading to full system compromise.\nPayload execution behavior is determined by the script injected by the attacker. Common examples include stealing document.cookie to hijack an active session, modifying the visible page content to facilitate phishing attacks, or performing unauthorized administrative actions such as creating new rogue user accounts with escalated privileges.\nThe attack is remotely exploitable and does not require local access to the server. The vulnerability is confirmed in Assessment Management 1.0. Given the public availability of the exploit code, the barrier to entry for an attacker is minimal, requiring only the ability to lure a legitimate user to the compromised URL or trigger the execution via a malicious request."
}