Exam Form Submission EUVD-2026-14367

While the CVSS 3.1 score of 2.4 is ostensibly low, the full risk picture requires multi-signal analysis. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N) indicates network accessibility (AV:N) and low attack complexity (AC:L), but the high privilege requirement (PR:H) and required user interaction (UI:R) substantially limit the practical attack surface. However, the environmental factors (E:P for published exploit, RL:X for unknown patch status, RC:R for reasonable confidence) elevate concern: public exploit availability increases reconnaissance velocity and lowers barriers to entry for even unsophisticated threat actors. The confined scope (S:U) and integrity-only impact (I:L) mean successful exploitation cannot escalate privileges or cause denial of service, but can modify displayed content, deface records, or inject malware vectors. From an SSVC perspective, this is not high-priority for most organizations given the authentication gate and low technical impact, but administrators of public-facing Exam Form Submission instances should patch promptly to prevent account compromise via social engineering or insider threats. This is a real but low-priority issue for most environments.

An administrative user with legitimate access to the Exam Form Submission system is socially engineered or falls victim to phishing and visits a malicious link injected by an attacker. The attacker has crafted a URL or form submission containing a JavaScript payload in the 'sname' parameter that, when processed by /admin/update_s2.php, is stored in the application database. When the administrator (or another privileged user) later views the exam submissions page, the malicious script executes in their browser with the user's privileges, allowing the attacker to steal their session token, modify exam grades, or create additional administrative accounts. The published GitHub proof-of-concept (https://github.com/yao536/cve/issues/1) provides a readily adaptable payload template, enabling rapid weaponization by threat actors.