CVE-2020-5745

Vulnerability

Cross-site request forgery (CSRF) in TCExam 14.2.2 allows a remote, unauthenticated attacker to perform sensitive application actions by tricking legitimate users, such as administrators, into clicking a crafted link or submitting a malicious form. The vulnerability exists because the application does not implement anti-CSRF tokens or sufficient validation of request origin, even when K_CHECK_SESSION_FINGERPRINT is enabled [1]. Affected version: TCExam 14.2.2 [1].

Exploitation

An attacker can craft a link or HTML form that triggers a state-changing request (e.g., editing user privileges) on the TCExam instance. The attacker must lure an authenticated user (typically an administrator) into clicking the link or submitting the form while that user's session is active. No authentication is required on the attacker's part, and the forged request is executed in the context of the victim's session. For example, a simple link can change user permissions without the victim's knowledge [1].

Impact

Successful exploitation enables the attacker to perform any action that the victim user is authorized to do, such as modifying user accounts, changing test configurations, or granting admin privileges to the attacker's account. This can lead to full administrative control of the TCExam application, compromising the confidentiality, integrity, and availability of data managed by the application [1].

Mitigation

As of the publication date (2020-05-07), no official patch or fixed version has been released by the vendor. Tenable recommends implementing CSRF protection mechanisms such as anti-CSRF tokens for all state-changing requests. A workaround is to enforce strict referer header checking or employ same-origin policy validation, though these are not foolproof. Users should monitor vendor channels for updates or consider restricting network access to the TCExam interface until a fix is available [1].