CVE-2025-13343: Janobe Interview Management XSS Vulnerability

CVE-2025-13343 is a cross-site scripting vulnerability in Janobe Interview Management System 1.0 affecting the editQuestion.php file. Attackers can inject malicious scripts through the Question parameter. This article covers technical details, affected versions, security impact, and mitigation strategies.

CVE-2025-13343 Overview

CVE-2025-13343 is a reflected cross-site scripting (XSS) vulnerability in SourceCodester Interview Management System 1.0, developed by Janobe. The flaw resides in the /editQuestion.php script, where the Question parameter is rendered without proper output encoding. An authenticated remote attacker can inject arbitrary JavaScript that executes in the browser context of any user who views the manipulated content. The exploit details have been publicly released, increasing the likelihood of opportunistic abuse against exposed deployments.

Critical Impact
Successful exploitation enables session hijacking, credential theft, and unauthorized actions performed in the context of authenticated interview management users.

Affected Products

Janobe Interview Management System 1.0
SourceCodester distribution of Interview Management System
Deployments referencing cpe:2.3:a:janobe:interview_management_system:1.0

Discovery Timeline

2025-11-18 - CVE-2025-13343 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-13343

Vulnerability Analysis

The vulnerability is classified under [CWE-79] Improper Neutralization of Input During Web Page Generation. The /editQuestion.php endpoint accepts the Question parameter and reflects the supplied value into the HTML response without sanitization or contextual encoding. Because the injected payload is executed by the victim's browser, attackers can run arbitrary scripts within the same origin as the application.

Exploitation requires low-privileged authenticated access and some user interaction, such as tricking a target into loading a crafted URL or record. The impact is scoped to the vulnerable component, resulting in limited integrity loss without direct effects on confidentiality or availability of the underlying host.

Root Cause

The root cause is missing input validation and output encoding on the Question field processed by editQuestion.php. User-supplied data is written into the response body without HTML-entity escaping or a Content Security Policy (CSP) capable of blocking inline script execution.

Attack Vector

An attacker with a valid low-privilege account submits a crafted Question value containing JavaScript. When an administrator or another user edits or reviews the affected question, the browser parses and executes the payload. This can be used to steal session cookies, pivot to CSRF-style actions, or deface application views.

No verified proof-of-concept code is published in the enriched dataset. See the GitHub CVE Issue Discussion and VulDB #332761 for community-provided technical details.

Detection Methods for CVE-2025-13343

Indicators of Compromise

HTTP POST or GET requests to /editQuestion.php containing script tags, javascript: URIs, or event-handler attributes such as onerror= or onload= in the Question parameter.
Unexpected outbound requests from user browsers to attacker-controlled domains shortly after loading interview management pages.
Anomalous session cookie usage from geographies or user agents that do not match the legitimate account owner.

Detection Strategies

Deploy web application firewall (WAF) signatures that flag XSS payload patterns targeting editQuestion.php.
Enable server-side logging of all parameters submitted to question management endpoints and review for HTML or JavaScript syntax.
Correlate authentication events with subsequent question edits to identify low-privilege accounts abusing the endpoint.

Monitoring Recommendations

Alert on repeated requests to /editQuestion.php where parameters contain angle brackets or encoded script fragments.
Monitor administrator sessions for unusual DOM activity, unexpected navigation, or credential resubmission prompts.
Track browser CSP violation reports if a policy is deployed, as these will surface blocked injection attempts.

How to Mitigate CVE-2025-13343

Immediate Actions Required

Restrict access to /editQuestion.php to trusted, authenticated administrators using network-level or application-level controls.
Apply server-side input validation that rejects HTML metacharacters in the Question parameter.
Implement HTML-entity encoding on all user-supplied fields before rendering them into responses.
Review audit logs for prior exploitation attempts against the endpoint.

Patch Information

No vendor advisory or official patch is referenced in the enriched dataset. Organizations should monitor the SourceCodester Resource Portal and the upstream project for future updates. Until a fix is available, mitigate through compensating controls and consider retiring the deployment if it is exposed to untrusted users.

Workarounds

Place the application behind a WAF with XSS filtering rules enabled and tuned to the editQuestion.php path.
Enforce a strict Content Security Policy that disallows inline scripts and restricts script sources to trusted origins.
Disable or remove the question editing feature if it is not required in the current deployment.
Rotate session tokens and require re-authentication for administrative users to invalidate any hijacked sessions.

bash

# Example nginx configuration to add a restrictive Content Security Policy
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'none'";
add_header X-XSS-Protection "1; mode=block";
add_header X-Content-Type-Options "nosniff";