CVE-2020-5746

Vulnerability

TCExam 14.2.2 suffers from insufficient output sanitization in the test creation functionality. An authenticated attacker with any user level can create a crafted test containing malicious payloads that are stored and later executed in the context of other users, including administrators. The vulnerability is present in the application's handling of test input fields.

Exploitation

An attacker must be authenticated to the TCExam application (any user level). The attacker creates a new test and injects malicious JavaScript or HTML into input fields that are not sanitized. When other users (e.g., administrators) view or manage the crafted test, the payload executes in their browser session. No additional user interaction is required beyond normal browsing.

Impact

Successful exploitation leads to persistent cross-site scripting (XSS) [1]. The attacker can execute arbitrary JavaScript in the context of the victim's session, potentially leading to session hijacking, privilege escalation, or performing administrative actions on behalf of the victim. Combined with other vulnerabilities (CSRF, directory traversal), this can allow complete compromise of the application.

Mitigation

As of the publication date (2020-05-07), TCExam 14.2.2 is vulnerable. Upgrading to a patched version is the primary mitigation. No workaround is provided in the available references [1]. The vendor should release a fix that properly sanitizes user input in test creation and other areas. Until then, restrict authenticated user access and monitor for suspicious test creation.