The code-projects Online Exam Mastering System version 1.0 suffers from a reflected Cross-Site Scripting (XSS) vulnerability in the feedback.php page, specifically via the "q" GET parameter. This vulnerability arises because the application fails to properly sanitize or encode user-supplied input before reflecting it back in the HTML response. An attacker can craft a malicious URL containing arbitrary JavaScript code embedded within the "q" parameter. When a victim, such as an administrator or privileged user, clicks this URL, the injected script executes in their browser context. The provided proof-of-concept demonstrates that a simple payload like <script>alert('XSS')</script> triggers JavaScript execution, confirming the vulnerability. The exploit code is written in Perl and targets the vulnerable parameter by sending crafted HTTP requests. The vulnerability was tested on a local setup using XAMPP with Apache and PHP 7.x, indicating the environment in which the flaw manifests. The impact of this reflected XSS includes potential account takeover through cookie theft, session hijacking, and the ability to execute arbitrary scripts in the victim’s browser. Attackers can leverage social engineering techniques to trick users into clicking malicious links, thereby compromising session integrity and confidentiality. No official patch or update is currently available from the vendor, and no known exploits are reported in the wild yet. However, the presence of exploit code on Exploit-DB increases the risk of exploitation. The vulnerability is identified as CVE-2025-28121. Mitigation involves proper input sanitization using functions like htmlspecialchars() in PHP to encode special characters, implementing Content Security Policy (CSP) headers to restrict script execution, and avoiding direct reflection of unsanitized GET parameters in HTML responses. These measures reduce the risk of script injection and execution. Overall, this reflected XSS vulnerability poses a moderate risk to deployments of this online exam system, especially where privileged users interact with the feedback functionality via web browsers.

For European organizations using the code-projects Online Exam Mastering System 1.0, this vulnerability can lead to significant security risks. Educational institutions, certification bodies, and training providers relying on this system may face session hijacking and account compromise if attackers successfully exploit the reflected XSS. This could result in unauthorized access to exam data, manipulation of feedback or exam results, and exposure of sensitive user information. The ability to execute arbitrary JavaScript also opens avenues for phishing attacks and malware delivery within trusted environments. Given the nature of the application, attackers targeting administrators or instructors could disrupt exam integrity or gain elevated privileges. The impact on confidentiality and integrity is notable, while availability is less directly affected. Since the vulnerability requires user interaction (clicking a malicious link), social engineering is a critical factor in exploitation. European organizations must be vigilant, especially those with web-facing instances of this software accessible to external users or staff.

1. Immediately audit all instances of the Online Exam Mastering System 1.0 to identify exposure of the feedback.php?q parameter to external users. 2. Apply input sanitization by modifying the source code to use PHP's htmlspecialchars() or equivalent encoding functions on all reflected user inputs before rendering them in HTML. 3. Implement a strict Content Security Policy (CSP) header that restricts script sources to trusted domains and disallows inline scripts, mitigating the impact of injected scripts. 4. Consider deploying a Web Application Firewall (WAF) with custom rules to detect and block common XSS payload patterns targeting the q parameter. 5. Educate users, especially administrators and instructors, about the risks of clicking untrusted links and encourage the use of security-aware browsing practices. 6. Monitor web server logs for suspicious requests containing script tags or unusual query parameters targeting feedback.php. 7. If possible, upgrade or patch the system once the vendor releases an official fix. 8. Restrict access to the feedback.php page to authenticated users only, reducing exposure to anonymous attackers. 9. Conduct regular security assessments and penetration tests focusing on input validation and output encoding in all web application components.