← Advisories

TCExam <=11.2.011 Multiple Cross-Site Scripting Vulnerabilities

Medium
Advisory ID
ZSL-2011-5025
Release Date
13 July 2011
Vendor
Tecnick.com s.r.l. - http://www.tcexam.org
Affected Version
11.2.009, 11.2.010 and 11.2.011
CVE
N/A
Tested On
Microsoft Windows XP Professional SP3 (EN), Apache 2.2.14 (Win32), PHP 5.3.1, MySQL 5.1.41
Summary

TCExam is a FLOSS system for electronic exams (also know as CBA - Computer-Based Assessment, CBT - Computer-Based Testing or e-exam) that enables educators and trainers to author, schedule, deliver, and report on quizzes, tests and exams.

Description

TCExam suffers from multiple pre and post auth XSS vulnerabilities when parsing user input to multiple parameters via GET and POST method in multiple scripts. Attackers can exploit these weaknesses to execute arbitrary HTML and script code in a user's browser session.

Proof of Concept
tcexam_xss.txtTXT
Disclosure Timeline
09.07.2011Vulnerability discovered.
10.07.2011Initial contact with the vendor.
11.07.2011Vendor responds asking more details.
11.07.2011Sent details to vendor.
12.07.2011Vendor confirms the issues.
12.07.2011Working with the vendor.
13.07.2011Vendor releases version 11.2.012 to address these issues.
13.07.2011Coordinated public security advisory released.
Credits
Vulnerability discovered by Gjoko Krstic
High five to Dr. Nicola Asuni
References
[1]http://sourceforge.net/projects/tcexam/files/tcexam_11_2_012.zip
[2]http://sourceforge.net/projects/tcexam/files/CHANGELOG.TXT
[3]http://packetstormsecurity.org/files/103035
[4]http://securityreason.com/wlb_show/WLB-2011070042
[5]http://secunia.com/advisories/45225/
[6]http://www.securityfocus.com/bid/48669
[7]http://osvdb.org/show/osvdb/73810
[8]http://osvdb.org/show/osvdb/73811
[9]http://osvdb.org/show/osvdb/73812
[10]http://osvdb.org/show/osvdb/73813
[11]http://osvdb.org/show/osvdb/73814
[12]http://osvdb.org/show/osvdb/73815
[13]http://osvdb.org/show/osvdb/73816
[14]http://osvdb.org/show/osvdb/73817
[15]http://osvdb.org/show/osvdb/73818
[16]http://osvdb.org/show/osvdb/73819
[17]http://osvdb.org/show/osvdb/73820
[18]http://osvdb.org/show/osvdb/73821
[19]http://osvdb.org/show/osvdb/73822
[20]http://osvdb.org/show/osvdb/73823
[21]http://osvdb.org/show/osvdb/73824
[22]http://xforce.iss.net/xforce/xfdb/68551
Changelog
13.07.2011Initial release
14.07.2011Added reference [3], [4], [5] and [6]
16.07.2011Added reference [7], [8], [9], [10], [11], [12], [13], [14], [15], [16], [17], [18], [19], [20] and [21]
19.07.2011Added reference [22]