CVE-2024-5123
📋 TL;DR
This vulnerability allows attackers to inject malicious scripts into the searchbar parameter of the Event Registration System, which are then executed in victims' browsers. It affects SourceCodester Event Registration System 1.0 users who have the vulnerable component exposed. Attackers can steal session cookies, redirect users, or perform actions on their behalf.
💻 Affected Systems
- SourceCodester Event Registration System
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers steal administrator session cookies, gain full system control, deface websites, or redirect users to malicious sites for credential theft.
Likely Case
Attackers steal user session cookies to hijack accounts, perform unauthorized actions, or display malicious content to users.
If Mitigated
With proper input validation and output encoding, the XSS payloads are neutralized before reaching users' browsers.
🎯 Exploit Status
Exploit code is publicly available on GitHub. Attack requires user interaction (visiting malicious link or page).
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None available
Restart Required: No
Instructions:
No official patch available. Consider implementing input validation and output encoding as workarounds.
🔧 Temporary Workarounds
Input Validation Filter
allImplement server-side validation to sanitize searchbar parameter input
Modify /registrar/ PHP files to filter <script> tags and JavaScript events
Output Encoding
allEncode user input before displaying in HTML context
Use htmlspecialchars() or similar functions in PHP output
🧯 If You Can't Patch
- Implement Web Application Firewall (WAF) with XSS protection rules
- Restrict access to /registrar/ directory to trusted IP addresses only
🔍 How to Verify
Check if Vulnerable:
Test by injecting <script>alert('XSS')</script> into searchbar parameter and check if script executesCheck Version:
Check system documentation or admin panel for version informationVerify Fix Applied:
Test same payload after fixes - script should not execute and should appear as plain text📡 Detection & Monitoring
Log Indicators:
- Unusual search queries containing script tags or JavaScript code
- Multiple failed XSS attempts
Network Indicators:
- HTTP requests to /registrar/ with suspicious parameters containing script tags
SIEM Query:
source="web_logs" AND uri_path="/registrar/" AND (query_string CONTAINS "<script>" OR query_string CONTAINS "javascript:")🔗 References
- https://github.com/BurakSevben/CVEs/blob/main/Event%20Registration%20System/Event%20Registration%20System%20-%20Cross-Site-Scripting%20-%201.md
- https://vuldb.com/?ctiid.265203
- https://vuldb.com/?id.265203
- https://vuldb.com/?submit.338616
- https://github.com/BurakSevben/CVEs/blob/main/Event%20Registration%20System/Event%20Registration%20System%20-%20Cross-Site-Scripting%20-%201.md
- https://vuldb.com/?ctiid.265203
- https://vuldb.com/?id.265203
- https://vuldb.com/?submit.338616
