SourceCodester Online Quiz System take-quiz.php cross site scripting
翻译中…平台
php
组件
online-quiz-system
修复版本
1.0.1
A problematic cross-site scripting (XSS) vulnerability has been identified in SourceCodester Online Quiz System versions 1.0 through 1.0. This flaw allows attackers to inject malicious scripts by manipulating the quiztaker/yearsection parameter within the take-quiz.php file. The vulnerability is remotely exploitable and has been publicly disclosed. A patch is available in version 1.0.1.
影响与攻击场景翻译中…
Successful exploitation of CVE-2023-6473 allows an attacker to execute arbitrary JavaScript code within the context of a user's browser session on the Online Quiz System. This could lead to session hijacking, credential theft, defacement of the quiz interface, or redirection to malicious websites. The attacker could potentially gain access to sensitive user data, such as quiz answers or personal information stored within the system. The impact is amplified if the quiz system is used in a sensitive environment, such as an educational institution or a corporate training program.
利用背景翻译中…
This vulnerability has been publicly disclosed and is tracked by VDB-246639. While the CVSS score is LOW, the ease of exploitation and potential impact warrant attention. Public proof-of-concept exploits may become available, increasing the risk of widespread exploitation. No active campaigns have been reported at the time of this writing, but monitoring is recommended.
哪些人处于风险中翻译中…
Organizations and individuals using SourceCodester Online Quiz System versions 1.0 through 1.0 are at risk. This includes educational institutions, training providers, and any entity utilizing the system for online quizzes or assessments. Shared hosting environments where multiple users share the same server instance are particularly vulnerable, as an attacker could potentially compromise other users' accounts.
检测步骤翻译中…
• php / web:
curl -I 'http://your-quiz-system.com/take-quiz.php?quiz_taker/year_section=<script>alert(1)</script>' | grep HTTP/1.1• generic web:
grep -i 'quiz_taker/year_section=' /var/log/apache2/access.log攻击时间线
- Disclosure
disclosure
- Patch
patch
威胁情报
漏洞利用状态
EPSS
0.08% (24% 百分位)
CVSS 向量
这些指标意味着什么？
- Attack Vector
- 网络 — 可通过互联网远程利用，无需物理或本地访问。攻击面最大。
- Attack Complexity
- 低 — 无需特殊条件，可以稳定地利用漏洞。
- Privileges Required
- 低 — 任何有效用户账户均可。
- User Interaction
- 需要 — 受害者必须打开文件、点击链接或访问特制页面。
- Scope
- 未改变 — 影响仅限于脆弱组件本身。
- Confidentiality
- 无 — 无机密性影响。
- Integrity
- 低 — 攻击者可修改部分数据，影响有限。
- Availability
- 无 — 无可用性影响。
受影响的软件
弱点分类 (CWE)
时间线
- 已保留
- 发布日期
- 修改日期
- EPSS 更新日期
缓解措施和替代方案翻译中…
The primary mitigation for CVE-2023-6473 is to upgrade to version 1.0.1 of the Online Quiz System. If upgrading is not immediately feasible, consider implementing input validation and sanitization on the quiztaker/yearsection parameter to prevent malicious input. Web application firewalls (WAFs) configured to detect and block XSS attacks can provide an additional layer of protection. Regularly review and update the Online Quiz System to ensure you are running the latest version with the latest security patches.
修复方法翻译中…
Actualizar a una versión parcheada o aplicar una solución que filtre y escape correctamente las entradas de usuario en el archivo `take-quiz.php`, especialmente los parámetros `quiz_taker` y `year_section`. Validar y limpiar las entradas antes de usarlas en la salida HTML para prevenir la inyección de código malicioso. Si no hay una versión parcheada disponible, considere deshabilitar o eliminar la funcionalidad vulnerable.
CVE 安全通讯
漏洞分析和关键警报直接发送到您的邮箱。
常见问题翻译中…
What is CVE-2023-6473 — XSS in Online Quiz System 1.0?
CVE-2023-6473 is a cross-site scripting (XSS) vulnerability affecting SourceCodester Online Quiz System versions 1.0–1.0, allowing attackers to inject malicious scripts via the quiztaker/yearsection parameter.
Am I affected by CVE-2023-6473 in Online Quiz System 1.0?
You are affected if you are using SourceCodester Online Quiz System versions 1.0–1.0. Upgrade to version 1.0.1 to mitigate the risk.
How do I fix CVE-2023-6473 in Online Quiz System 1.0?
Upgrade to version 1.0.1 of the Online Quiz System. As a temporary workaround, implement input validation and sanitization on the quiztaker/yearsection parameter.
Is CVE-2023-6473 being actively exploited?
While no active campaigns have been reported, the vulnerability is publicly disclosed and potentially exploitable, so monitoring is recommended.
Where can I find the official SourceCodester advisory for CVE-2023-6473?
Refer to the SourceCodester website or their official communication channels for the advisory related to CVE-2023-6473.