Overview
W. W. Norton InQuizitive, an educational platform widely used by students, was discovered to contain a serious vulnerability that could allow students to insert arbitrary records of their quiz performance into the backend. This vulnerability, designated as CVE-2025-32808, is of particular concern as it could result in potential system compromise or data leakage.
Vulnerability Summary
CVE ID: CVE-2025-32808
Severity: High (7.7 CVSS Score)
Attack Vector: Network
Privileges Required: None
User Interaction: Required
Impact: Unauthorized modification of quiz performance records, potential system compromise, and data leakage
Affected Products
Escape the Surveillance Era
Most apps won’t tell you the truth.
They’re part of the problem.
Phone numbers. Emails. Profiles. Logs.
It’s all fuel for surveillance.
Ameeba Chat gives you a way out.
- • No phone number
- • No email
- • No personal info
- • Anonymous aliases
- • End-to-end encrypted
Chat without a trace.
Product | Affected Versions
W. W. Norton InQuizitive | All versions through 2025-04-08
How the Exploit Works
The exploit takes advantage of the lack of proper server-side access control in InQuizitive. An attacker, in this case, a student, can manipulate the client-side interface to insert arbitrary performance data into the backend database. This is possible because the validation and access control are only implemented on the client-side, which can be bypassed by a knowledgeable user.
Conceptual Example Code
The following is a conceptual example of how the vulnerability might be exploited. It represents a HTTP POST request, where a student sends an altered JSON payload to manipulate the quiz performance data in the backend.
POST /submit_quiz HTTP/1.1
Host: inquizitive.wwnorton.com
Content-Type: application/json
{
"user_id": "student123",
"quiz_id": "quiz567",
"quiz_score": 100
}In this example, the student with user_id “student123” changes their quiz_score to 100, regardless of their actual performance. As there is no server-side validation, the score is accepted and inserted into the backend database.
