CVE-2025-32808
📋 TL;DR
CVE-2025-32808 is a client-side access control vulnerability in W. W. Norton InQuizitive that allows students to insert arbitrary records of their quiz performance into the backend system. This affects all users of InQuizitive through April 8, 2025, enabling grade manipulation and potential stored XSS attacks.
💻 Affected Systems
- W. W. Norton InQuizitive
📦 What is this software?
Inquizitive by Wwnorton
⚠️ Risk & Real-World Impact
Worst Case
Students could manipulate academic records at scale, inject malicious scripts affecting other users, and compromise the integrity of the entire grading system.
Likely Case
Students manipulating their own quiz scores and grades, potentially affecting academic integrity and institutional trust.
If Mitigated
With proper server-side validation and access controls, only legitimate quiz submissions would be accepted, preventing unauthorized record insertion.
🎯 Exploit Status
Exploitation requires student-level access but is technically simple; detailed analysis available in referenced Medium articles.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: Not available
Restart Required: No
Instructions:
1. Contact W. W. Norton for security updates. 2. Monitor official channels for patch announcements. 3. Apply any available updates immediately.
🔧 Temporary Workarounds
Implement Server-Side Validation
allAdd server-side validation for all quiz submissions before accepting them into the backend database.
Temporary Access Restrictions
allRestrict student access to quiz submission endpoints or implement rate limiting.
🧯 If You Can't Patch
- Monitor quiz submission logs for anomalous patterns or bulk insertions
- Implement manual review processes for suspicious grade changes
🔍 How to Verify
Check if Vulnerable:
Test if quiz submissions can be manipulated via browser developer tools or proxy interception without server-side validation.Check Version:
Check InQuizitive interface or contact vendor for version information.Verify Fix Applied:
Verify that all quiz submissions undergo server-side validation and cannot be arbitrarily modified client-side.📡 Detection & Monitoring
Log Indicators:
- Unusual quiz submission patterns
- Multiple rapid submissions from single users
- Modified submission payloads
Network Indicators:
- HTTP requests with manipulated quiz data parameters
- Unusual API call sequences to submission endpoints
SIEM Query:
source="inquizitive_logs" AND (event="quiz_submission" AND (parameter_tampering="true" OR submission_rate > threshold))