CVE-2024-46334
📋 TL;DR
This vulnerability allows attackers to inject malicious scripts into the kashipara School Management System login page via formuser and formpassword parameters. When an administrator views compromised login logs or error pages, the scripts execute in their browser context. All users running version 1.0 of this PHP-based system are affected.
💻 Affected Systems
- kashipara School Management System
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers could steal administrator session cookies, perform actions as administrators (add/delete users, modify grades), or redirect users to malicious sites.
Likely Case
Session hijacking leading to unauthorized administrative access and data manipulation within the school management system.
If Mitigated
Limited impact with proper input validation and output encoding, though some functionality disruption may occur.
🎯 Exploit Status
Exploitation requires tricking administrators into viewing maliciously crafted login attempts or error pages.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: Not available
Restart Required: No
Instructions:
No official patch available. Implement input validation and output encoding in /adminLogin.php for formuser and formpassword parameters.
🔧 Temporary Workarounds
Input Validation and Output Encoding
allAdd server-side validation and HTML encoding for formuser and formpassword parameters
Edit /adminLogin.php to add htmlspecialchars() or similar encoding functions
Web Application Firewall (WAF)
allDeploy WAF rules to block XSS payloads in login parameters
Add WAF rule: Detect and block scripts in formuser/formpassword parameters
🧯 If You Can't Patch
- Restrict access to adminLogin.php to trusted IP addresses only
- Implement Content Security Policy (CSP) headers to prevent script execution
🔍 How to Verify
Check if Vulnerable:
Test by submitting <script>alert('XSS')</script> in formuser or formpassword fields and check if script executes when viewing login logs/errorsCheck Version:
Check source code or documentation for version 1.0 referenceVerify Fix Applied:
After implementing fixes, repeat XSS test to confirm scripts no longer execute📡 Detection & Monitoring
Log Indicators:
- Unusual script tags in login attempt logs
- Multiple failed login attempts with encoded payloads
Network Indicators:
- HTTP requests to adminLogin.php containing script tags or JavaScript in parameters
SIEM Query:
source="web_logs" AND uri="/adminLogin.php" AND (param="formuser" OR param="formpassword") AND (content="<script>" OR content="javascript:")