bookevent endpoint accepts spoofed completion data for self-graded activities

What Course are you in
N/A

What Page were you on
N/A

What is your username
N/A

Describe the bug
This is a client-side scoring vulnerability that affects multiple self-graded activity types in Runestone Academy.

The bookevent endpoint accepts forged JSON payloads containing correct: "T" and percent: 1, awarding full credit regardless of the actual input. There appears to be no server-side validation to confirm correctness. This affects:

• Multiple Choice
• Drag and Drop
• ActiveCode
• Parsons Problems (with a slightly different payload structure)

Because the platform relies on client-reported scoring data, users can spoof activity completion using developer tools and crafted fetch() requests.

I’ve created a small set of proof-of-concept scripts to demonstrate the issue. These are provided for educational and responsible disclosure purposes only.

PoC repository:
https://github.com/SRHackerr/runestone-answer-spoof-poc

Traceback

Javascript Errors
None encountered. All spoofed requests returned HTTP 200/201 with no errors in the console.

Start by tracing the bookevent endpoint and its handling of the payloads described in the proof-of-concept repository. Compare the request structures for Multiple Choice, Drag and Drop, ActiveCode, and Parsons Problems; done means forged completion data no longer awards credit for any listed activity.