CVE-2024-35345
📋 TL;DR
This vulnerability allows attackers to inject malicious scripts via the 'id' parameter in Diño Physics School Assistant, resulting in cross-site scripting (XSS). It affects users of version 2.3 who access the vulnerable /classes/Users.php file. Attackers could steal session cookies or redirect users to malicious sites.
💻 Affected Systems
- Diño Physics School Assistant
📦 What is this software?
Dino Physics School Assistant by Dino Physics School Assistant Project
⚠️ Risk & Real-World Impact
Worst Case
Attackers steal administrator credentials, compromise user accounts, deface the application, or redirect users to phishing sites.
Likely Case
Session hijacking, credential theft, or defacement of vulnerable pages.
If Mitigated
Limited impact with proper input validation, output encoding, and Content Security Policy (CSP) in place.
🎯 Exploit Status
XSS vulnerabilities are commonly exploited; public references exist but no confirmed weaponization.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: Unknown
Restart Required: No
Instructions:
1. Check vendor for updated version. 2. If unavailable, implement input validation and output encoding in /classes/Users.php. 3. Deploy changes and test.
🔧 Temporary Workarounds
Implement Input Validation
allAdd server-side validation to sanitize the 'id' parameter in /classes/Users.php.
Edit /classes/Users.php to filter or encode user input for the 'id' parameter.
Enable Content Security Policy (CSP)
allConfigure CSP headers to restrict script execution from untrusted sources.
Add 'Content-Security-Policy' header in web server configuration (e.g., Apache, Nginx).
🧯 If You Can't Patch
- Deploy a Web Application Firewall (WAF) with XSS protection rules.
- Restrict access to the application to trusted users only using network controls.
🔍 How to Verify
Check if Vulnerable:
Test by injecting a script payload into the 'id' parameter of requests to /classes/Users.php and check if it executes.Check Version:
Check application version in admin panel or configuration files; look for '2.3'.Verify Fix Applied:
Re-test with the same payload; ensure it is sanitized or blocked and does not execute.📡 Detection & Monitoring
Log Indicators:
- Unusual 'id' parameter values containing script tags or JavaScript in access logs.
Network Indicators:
- HTTP requests with malicious scripts in query parameters to /classes/Users.php.
SIEM Query:
source="web_logs" AND uri="/classes/Users.php" AND (query CONTAINS "<script>" OR query CONTAINS "javascript:")