CVE-2024-10090
📋 TL;DR
CVE-2024-10090 is a reflected cross-site scripting (XSS) vulnerability in SoftCOM iKSORIS Internet Starter module. Attackers can trick users into submitting malicious scripts through user addition forms, executing arbitrary code in the victim's browser context. Organizations using vulnerable versions of iKSORIS systems are affected.
💻 Affected Systems
- SoftCOM iKSORIS Internet Starter module
📦 What is this software?
Iksoris by Softcom.wroc
⚠️ Risk & Real-World Impact
Worst Case
Attackers could steal session cookies, perform actions as authenticated users, redirect to malicious sites, or install malware on user systems.
Likely Case
Session hijacking, credential theft, or defacement of the application interface through injected scripts.
If Mitigated
Limited impact with proper input validation, output encoding, and Content Security Policy (CSP) headers in place.
🎯 Exploit Status
Reflected XSS typically requires social engineering but has low technical complexity.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 79.0
Vendor Advisory: https://www.iksoris.pl/system-rezerwacji-i-sprzedazy-biletow-iksoris.html
Restart Required: Yes
Instructions:
1. Download version 79.0 or later from SoftCOM iKSORIS vendor. 2. Backup current installation. 3. Apply the update following vendor instructions. 4. Restart the iKSORIS service. 5. Verify the update was successful.
🔧 Temporary Workarounds
Implement Web Application Firewall (WAF)
allDeploy a WAF with XSS protection rules to filter malicious input.
Add Content Security Policy
allImplement strict CSP headers to restrict script execution sources.
Content-Security-Policy: default-src 'self'; script-src 'self'
🧯 If You Can't Patch
- Implement input validation and output encoding on all user-controllable inputs
- Educate users about phishing risks and suspicious form submissions
🔍 How to Verify
Check if Vulnerable:
Check iKSORIS version in administration panel or configuration files. If version is below 79.0, system is vulnerable.Check Version:
Check iKSORIS admin interface or configuration files for version informationVerify Fix Applied:
Confirm version is 79.0 or higher in administration panel and test form inputs with basic XSS payloads (e.g., <script>alert('test')</script>) to ensure they are properly sanitized.📡 Detection & Monitoring
Log Indicators:
- Unusual form submissions with script tags or JavaScript code
- Multiple failed login attempts following suspicious form submissions
Network Indicators:
- HTTP requests containing script tags or JavaScript in form parameters
- Unusual redirects from iKSORIS forms
SIEM Query:
source="iKSORIS_logs" AND ("<script>" OR "javascript:" OR "onerror=" OR "onload=")