CVE-2020-5749

Vulnerability

TCExam 14.2.2 fails to sanitize output when displaying group names, enabling a persistent cross-site scripting (XSS) vulnerability. An authenticated user with permission to create groups can inject arbitrary HTML or JavaScript into the group name field. This stored payload is then executed in the browsers of other users who view the affected group. [1]

Exploitation

An attacker must have a valid account with privileges to create groups in TCExam 14.2.2. The attacker crafts a group name containing malicious script, such as ``. When other users, including administrators, navigate to pages that display the group list, the script executes in their browser context. [1]

Impact

Successful exploitation allows the attacker to execute arbitrary JavaScript in the context of the victim's session. This can lead to session hijacking, credential theft, or further actions such as performing administrative operations on behalf of the victim. The attacker may also leverage this XSS in combination with CSRF vulnerabilities to escalate privileges, as noted in the Tenable advisory. [1]

Mitigation

As of the publication date (2020-05-07), no official patch has been released for TCExam 14.2.2. The vendor has not responded to the disclosure. Users should consider upgrading to a newer version if available, or implement input sanitization and output encoding as a workaround. The vulnerability is not listed on CISA's Known Exploited Vulnerabilities (KEV) catalog. [1]