CVE-2026-4973

Vulnerability

Overview A stored cross-site scripting (XSS) vulnerability exists in SourceCodester Online Quiz System version 1.0. The flaw resides in the endpoint/add-question.php file, where the quiz_question parameter is not sanitized before being stored in the database. When the stored data is later rendered in quiz.php and take-quiz.php without output encoding (e.g., htmlspecialchars), any injected JavaScript executes in the browsers of users viewing those pages [1].

Exploitation

Prerequisites An attacker must have teacher-level access to the application to reach the Add Question functionality. No additional authentication is required beyond a valid teacher account. The attack is performed remotely by submitting a crafted payload in the quiz_question field. The payload is stored and automatically executed when any user (including students) visits the affected quiz pages [1].

Impact

Successful exploitation allows the attacker to execute arbitrary JavaScript in the context of the victim's session. This can lead to session hijacking, account takeover, phishing attacks, or unauthorized actions on behalf of the victim. Because the payload is stored and affects all users who view the quiz, the impact extends beyond a single victim [1].

Mitigation

As of the publication date, no official patch has been released by SourceCodester. The vendor has not acknowledged the vulnerability. Users are advised to apply input sanitization (e.g., htmlspecialchars) on the quiz_question parameter and ensure output encoding in quiz.php and take-quiz.php. Given the public availability of exploit details, immediate remediation is recommended [1].