RRJ Nueva Ecija Engineer Online Portal Quiz add_quiz.php cross site scripting

The vulnerability lies in the handling of user input within the add_quiz.php file, specifically the Quiz Title and Quiz Description fields. An attacker can inject JavaScript code by crafting malicious input containing tags like </title><scRipt>alert(x)</scRipt>. When this input is displayed to other users, the injected script executes in their browser context. This could allow an attacker to steal session cookies, redirect users to phishing sites, or modify the content of the page. The remote nature of the vulnerability means an attacker doesn't need local access to exploit it.

Organizations using the RRJ Nueva Ecija Engineer Online Portal version 1.0 are at risk. This includes engineering firms, construction companies, or any entity utilizing this specific portal for project management or communication. Shared hosting environments where multiple users share the same server instance are particularly vulnerable, as a successful attack could potentially impact other users on the same server.

• generic web: Use curl to test the add_quiz.php endpoint with a payload like <script>alert(x)</script> in the Quiz Title/Quiz Description parameters. Check the response for the alert box.

curl -d "Quiz Title=<script>alert(x)</script>" http://your-portal-url/add_quiz.php

• generic web: Examine access and error logs for suspicious requests containing <script> tags or other XSS payloads targeting add_quiz.php. • generic web: Inspect the HTML source code of pages displaying quiz information for any unsanitized user input from the Quiz Title/Quiz Description fields.

1. 2024-01-02Disclosure

   disclosure

2. 2024-01-02Patch

   patch

1. Gereserveerd2024-01-02
2. Gepubliceerd2024-01-02
3. Gewijzigd2025-06-17
4. EPSS bijgewerkt2026-04-02

The primary mitigation for CVE-2024-0190 is to upgrade the RRJ Nueva Ecija Engineer Online Portal to version 1.0.1 or later, which includes the fix. If upgrading immediately is not possible, consider implementing input validation and output encoding on the Quiz Title and Quiz Description fields to sanitize user input. Web application firewalls (WAFs) configured to detect and block XSS payloads can also provide a temporary layer of protection. After upgrading, verify the fix by attempting to inject a simple JavaScript alert in the Quiz Title/Quiz Description fields and confirming that the script does not execute.