SourceCodester Online Quiz System add-question.php cross site scripting

An attacker can exploit this XSS vulnerability to inject arbitrary JavaScript code into the SourceCodester Online Quiz System. This code could be executed in the context of a user's browser when they access the affected page. The impact ranges from simple defacement of the quiz system to more severe consequences like stealing user session cookies, redirecting users to malicious websites, or even gaining control of the user's account. Given the quiz system's potential use in educational or assessment settings, this could compromise sensitive user data and system integrity. The public availability of the exploit increases the risk of immediate exploitation.

Organizations and individuals using SourceCodester Online Quiz System version 1.0, particularly those hosting the application on shared hosting environments or without robust security monitoring, are at increased risk. Educational institutions and businesses relying on the quiz system for assessments or training are also vulnerable.

• php / web:

curl -s -X POST "http://<target>/add-question.php?quiz_question=<script>alert('XSS')</script>" | grep "<script>alert('XSS')</script>"

• generic web:

curl -I http://<target>/add-question.php?quiz_question=<script>alert('XSS')</script>

• generic web: Examine access logs for requests to /add-question.php containing suspicious JavaScript code in the quiz_question parameter.

1. 2026-03-27Disclosure

   disclosure

1. Reserviert2026-03-27
2. Veröffentlicht2026-03-27
3. Geändert2026-03-30
4. EPSS aktualisiert2026-04-04

The primary mitigation for CVE-2026-4973 is to upgrade to a patched version of SourceCodester Online Quiz System as soon as it becomes available. Until then, several temporary measures can be implemented. First, implement strict input sanitization on the quizquestion parameter within the /add-question.php file. Second, configure a Web Application Firewall (WAF) to filter out potentially malicious JavaScript code. Third, review and harden the application's security configuration, ensuring proper output encoding and escaping. After applying mitigations, verify the fix by attempting to inject a simple JavaScript payload through the quizquestion parameter and confirming it is not executed.