Administrator-session script execution via unsanitized user names

Stored XSS in Tecnick.com LTD TCExam 14.2.2 allows remote attackers to execute JavaScript in an administrator's browser. The self-registration handler stores script-bearing first- and last-name values, and tce_show_online_users.php later emits the derived user_str without output sanitization. Self-registration must be enabled, the attacker must log in, and an administrator must view the online-users page; the script then runs with that administrator's session privileges.