Description

A vulnerability was determined in code-projects Assessment Management 1.0. Affected by this vulnerability is an unknown functionality of the file lecturer/add-single-mark.php. This manipulation of the argument mark causes cross site scripting. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "3.5",
  "pubDate": "2026-09-20T11:16:57.750Z",
  "pubdate": "2026-09-20T11:16:57.750Z",
  "executiveSummary": "A Cross-Site Scripting (XSS) vulnerability exists in the Assessment Management 1.0 application, specifically within the lecturer/add-single-mark.php component.\nThe vulnerability allows an unauthenticated or remote attacker to inject malicious client-side scripts into the application's interface.\nBy manipulating the 'mark' argument, an attacker can force the execution of arbitrary JavaScript within the context of a victim's browser session.\nThe impact includes potential session hijacking, unauthorized access to sensitive user data, and the manipulation of displayed page content.\nThis vulnerability is classified as a significant security risk, as the exploit is publicly disclosed and can be leveraged by remote actors without complex prerequisites.\nAffected systems are restricted to version 1.0 of the Assessment Management product.",
  "technicalDetails": "The vulnerability originates from improper input validation and output encoding within the lecturer/add-single-mark.php script. The application fails to sanitize the 'mark' argument before reflecting it back to the user within the HTML response body.\nThis constitutes a classic Reflected Cross-Site Scripting (XSS) flaw, where the server-side code processes the user-supplied input from the HTTP request and renders it directly into the DOM without verifying its safety or applying context-aware encoding.\nThe exploitation process typically involves an attacker crafting a malicious URL containing a JavaScript payload within the 'mark' parameter. When an unsuspecting user, such as a lecturer or administrator, clicks this link, the application processes the request and embeds the payload into the rendered HTML page.\nBecause the payload is delivered via the application's own origin, the victim's browser treats the script as trusted content. Consequently, the script executes within the security context of the application's domain, granting the attacker access to sensitive information stored in the browser, such as cookies, local storage, and session tokens.\nThe attack flow follows a predictable sequence: First, the attacker identifies the vulnerable endpoint at lecturer/add-single-mark.php. Second, the attacker constructs a payload, such as '<script>alert(document.cookie)</script>', and assigns it to the 'mark' parameter. Third, the attacker lures the target into executing the request through social engineering or embedded links. Fourth, the server processes the input and returns a response containing the unencoded payload. Finally, the victim's browser executes the script, facilitating an unauthorized action or data exfiltration.\nThe lack of adequate server-side input filtering on the 'mark' variable allows for arbitrary script injection. Since the vulnerability is publicly disclosed, the barrier to entry for exploitation is low, requiring minimal technical expertise to weaponize the existing disclosure against vulnerable deployments of Assessment Management 1.0."
}