CVE-2025-63713
📋 TL;DR
This Cross-Site Scripting (XSS) vulnerability in SourceCodester MatchMaster 1.0 allows attackers to inject malicious scripts into test titles and matching pair items. When users execute tests containing this malicious content, the scripts run in their browsers, potentially stealing session cookies or performing unauthorized actions. All users of MatchMaster 1.0 who create or execute custom tests are affected.
💻 Affected Systems
- SourceCodester MatchMaster
📦 What is this software?
Matching Type Test by Remyandrade
⚠️ Risk & Real-World Impact
Worst Case
Attackers could steal administrator session cookies, take over administrative accounts, deface the application, or redirect users to malicious sites.
Likely Case
Attackers steal user session cookies to hijack accounts, perform unauthorized actions on behalf of users, or display phishing content.
If Mitigated
With proper input validation and output encoding, malicious scripts are neutralized and rendered as harmless text.
🎯 Exploit Status
Exploitation requires creating or modifying tests, which typically requires authentication. The vulnerability is in the test execution phase where crafted content is rendered.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Not available
Vendor Advisory: Not available
Restart Required: No
Instructions:
No official patch available. Implement input validation and output encoding in the application code.
🔧 Temporary Workarounds
Implement Input Validation
allAdd server-side validation to reject or sanitize HTML/script content in test titles and matching pair items.
Implement Output Encoding
allEncode user input before rendering in the DOM using appropriate encoding functions for HTML contexts.
🧯 If You Can't Patch
- Disable custom test creation feature entirely
- Implement a web application firewall (WAF) with XSS protection rules
🔍 How to Verify
Check if Vulnerable:
Create a test with title containing <script>alert('XSS')</script> and execute it. If alert pops up, system is vulnerable.Check Version:
Check application version in admin panel or source code documentationVerify Fix Applied:
After implementing fixes, repeat the test creation with malicious payload. Alert should not execute and payload should be displayed as text.📡 Detection & Monitoring
Log Indicators:
- Unusual test creation patterns
- Test titles containing script tags or JavaScript code
Network Indicators:
- HTTP requests with script payloads in POST data to test creation endpoints
SIEM Query:
source="web_logs" AND (uri="/create-test" OR uri="/save-test") AND (body CONTAINS "<script>" OR body CONTAINS "javascript:")