CVE-2024-11243
📋 TL;DR
This is a reflected cross-site scripting (XSS) vulnerability in code-projects Online Shop Store 1.0 that allows attackers to inject malicious scripts via the 'm2' parameter in /signup.php. Attackers can steal user cookies, redirect users, or perform actions on their behalf. Anyone running the vulnerable version of this software is affected.
💻 Affected Systems
- code-projects Online Shop Store
📦 What is this software?
Online Shop Store by Code Projects
⚠️ Risk & Real-World Impact
Worst Case
Attackers steal administrator session cookies, gain full administrative access to the online shop, modify products, steal customer data, or deface the website.
Likely Case
Attackers steal user session cookies to hijack accounts, redirect users to phishing sites, or display malicious content.
If Mitigated
With proper input validation and output encoding, the attack fails and no malicious script executes.
🎯 Exploit Status
Exploit requires user interaction (visiting a malicious link) but is trivial to execute with publicly available proof-of-concept.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://code-projects.org/
Restart Required: No
Instructions:
No official patch available. Implement input validation and output encoding in /signup.php to sanitize the 'm2' parameter.
🔧 Temporary Workarounds
Input Validation Filter
allAdd server-side validation to reject or sanitize malicious input in the 'm2' parameter
Edit /signup.php to add: $m2 = htmlspecialchars($_GET['m2'], ENT_QUOTES, 'UTF-8');
Web Application Firewall Rule
allBlock requests containing XSS payloads in the m2 parameter
WAF rule: Block if request_uri contains '/signup.php' and query_string contains pattern '<svg.*onload='
🧯 If You Can't Patch
- Disable or restrict access to /signup.php if not needed
- Implement Content Security Policy (CSP) headers to restrict script execution
🔍 How to Verify
Check if Vulnerable:
Test by accessing: http://yoursite.com/signup.php?m2=<svg%20onload=alert('XSS')> and check if alert executesCheck Version:
Check software version in admin panel or readme filesVerify Fix Applied:
Test the same payload and verify no script executes and input is properly encoded📡 Detection & Monitoring
Log Indicators:
- HTTP requests to /signup.php with m2 parameter containing script tags or SVG elements
- Unusual parameter values in access logs
Network Indicators:
- HTTP GET requests with XSS payloads in query parameters
- Traffic patterns showing exploitation attempts
SIEM Query:
source="web_access_logs" AND uri_path="/signup.php" AND query_string="*m2=*<svg*onload=*"