SourceCodester Interview Management System editQuestion.php cross site scripting

The XSS vulnerability in Interview Management System allows an attacker to inject arbitrary JavaScript code into the application. This code can then be executed in the context of a victim's browser when they access a crafted URL. An attacker could leverage this to steal session cookies, redirect users to malicious websites, or deface the application's interface. The remote nature of the vulnerability means an attacker doesn't need to be authenticated to exploit it, significantly expanding the potential attack surface. Given the public availability of an exploit, immediate action is crucial to prevent widespread compromise.

Organizations utilizing SourceCodester Interview Management System, particularly those with publicly accessible instances or those lacking robust input validation practices, are at significant risk. Shared hosting environments where multiple users share the same server are also particularly vulnerable, as a compromise of one user's account could potentially impact others.

• php / web:

curl -I 'http://your-interview-system/editQuestion.php?Question=<script>alert(1)</script>' | grep -i 'content-type'

• generic web:

curl -s 'http://your-interview-system/editQuestion.php?Question=<script>alert(1)</script>' | grep 'alert(1)'

1. 2025-11-18Disclosure

   disclosure

2. 2025-11-18PoC

   poc

1. Réservé2025-11-18
2. Publiée2025-11-18
3. EPSS mis à jour2026-03-23

The primary mitigation for CVE-2025-13343 is to immediately upgrade to version 1.0.1 of SourceCodester Interview Management System. If upgrading is not immediately feasible, consider implementing input validation and output encoding on the 'Question' parameter within the /editQuestion.php file. Web application firewalls (WAFs) configured to detect and block XSS payloads can provide an additional layer of defense. Monitor application logs for suspicious activity, particularly requests to /editQuestion.php with unusual parameters. After upgrading, confirm the vulnerability is resolved by attempting to inject a simple XSS payload through the 'Question' parameter and verifying it is properly sanitized.