InQuizitive Score Manipulation and Stored XSS Vulnerability Analysis

Critical Vulnerability Information Vulnerability Types Client-Side Injection LMS Trust Bypass Stored XSS Impact Perfect Score Injection: Achieve full marks without answering any questions. Faked Completion Status: Trigger LMS sync, resulting in recorded grades. Potential Stored XSS Vector: May affect other users. Unvalidated Score Submission: Client can arbitrarily modify and submit scores without server-side validation. Root Cause The platform relies entirely on client-side JavaScript values for reporting scores. The function sends data back to the server and LMS, but no validation is performed on the source or integrity of the data. Reproduction Steps 1. Open the InQuizitive platform (preferably via LMS). 2. Open the developer tools console. 3. Paste and execute specific JavaScript code to manipulate scores. 4. Refresh the chapter summary or LMS gradebook to see perfect scores and flawless performance displayed. Why It Happened InQuizitive executes all critical grading logic on the frontend. JavaScript objects and functions are globally accessible, executable, and modifiable within the window scope. The platform performs no authentication, authorization, or validation checks before accepting score submissions. What a Remote Attacker Can Do Skip questions. Directly manipulate scores, time spent, and performance history. Submit seemingly legitimate perfect scores, maintaining consistency across InQuizitive UI and connected LMS. Stored XSS PoC Attackers can inject malicious scripts via the method. When these entries are rendered in teacher dashboards, student review pages, or analytics tools, XSS is triggered. Consequences Impact on student feedback views. Teacher review views. Classroom activity logs. If descriptions are displayed in tooltips or summary reports, ROOM — XSS affects anyone viewing them. Yikes! This Could Be Worse Initial vulnerability allows students to tamper with their own quiz data. The real danger lies in injecting stored XSS payloads into data later rendered in privileged contexts (e.g., teacher dashboards, LMS integrations). Example Attack Scenarios Stored XSS - Teacher Session Hijacking Cross-Platform LMS Attacks (Canvas, Blackboard, etc.) Automated Grade Changes Export All Student Data to Remote Server Inject Additional JavaScript into Future Quizzes or Feedback Fields Summary This vulnerability demonstrates how fragile client-side logic is without proper server-side validation, and how it can be exploited for various attacks, including grade manipulation and cross-site scripting.

Goal Reached Thanks to every supporter — we hit 100%!

InQuizitive Score Manipulation and Stored XSS Vulnerability Analysis