Skip to content

Image Histogram_Quiz #293

Description

@shradhasehgal

Defect description:

The user's answers for the Image Histogram quiz are stored in a hidden input element within the <form name="quizform"> which is a string of space separated digits. These values can be edited to manipulate the answers of the user after the user has completed the questions.
This potentially exposes a flaw for a script to be set up which changes the answer of the users to the correct ones regardless of what the user inputs.

Steps to reproduce the issue:

Go to the Image Histogram Quiz

  1. Submit the first three questions without selecting any answers
  2. Open the console of your browser
  3. Find the hidden input with name="answers"
  4. Double click the value and change the value of the most recent answer (for the 3rd question) to 4 (which happens to be the correct answer for the 3rd questions)
  5. Continue to submit the next two questions without selecting any answer
  6. Complete the quiz with any answers to get the the result page
  7. Observe how the 3rd questions is marked correct despite not selecting any option in the quiz

Expected result :

All answers should be marked as incorrect and 0% should be awarded in the quiz.

Actual result:

The 3rd answer is marked as correct and 'You answered Correctly' is displayed.

Screenshot:

umm

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Fields

    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions