Executive brief
ProjectWorlds Online Examination System is a web-based platform that allows organizations to conduct online exams and collect feedback from users. A vulnerability in the feedback form allows attackers to inject malicious JavaScript code that executes in administrators' browsers when they view submitted feedback, potentially enabling account takeover and unauthorized access to exam data.
Technical details
A stored cross-site scripting (XSS) vulnerability exists in feedback.php due to insufficient input sanitization of the Name and Subject fields. The unsanitized user input is stored in a database and later rendered without output encoding in the admin dashboard (dash.php?q=3). An unauthenticated attacker can submit a feedback form with JavaScript payloads in the Name or Subject field; when an administrator views the feedback, the payload executes in their authenticated session, enabling session hijacking, CSRF attacks, or full account compromise. The vulnerability is confirmed exploitable and public disclosure has occurred; a fix involving output encoding (htmlspecialchars or equivalent) on both storage and render is recommended.
Affected products
- ProjectWorlds Online Examination System 1.0
Timeline
- 2026-09-07: disclosed: Publicly disclosed vulnerability
- 2026-07-22: other: Vulnerability discovered