CVE-2024-57326
📋 TL;DR
A reflected XSS vulnerability in Online Pizza Delivery System 1.0 allows attackers to inject malicious JavaScript via the search parameter in search.php. This affects all users who access the vulnerable search functionality. Attackers can steal session cookies, redirect users, or perform actions on their behalf.
💻 Affected Systems
- Online Pizza Delivery System
📦 What is this software?
Online Pizza Delivery System by Online Pizza Delivery System Project
⚠️ Risk & Real-World Impact
Worst Case
Attacker steals admin session cookies, gains full system control, accesses customer PII, and modifies orders/payments.
Likely Case
Attacker steals user session cookies to hijack accounts, redirects users to phishing sites, or performs limited actions within user context.
If Mitigated
With proper input sanitization and Content Security Policy, impact is limited to script execution in isolated sandbox without access to sensitive data.
🎯 Exploit Status
Simple reflected XSS with public proof-of-concept available. No authentication required to trigger vulnerability.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Not available
Vendor Advisory: Not available
Restart Required: No
Instructions:
1. Download search.php from GitHub reference
2. Replace vulnerable search.php file
3. Add input validation to sanitize search parameter
4. Implement Content Security Policy headers
🔧 Temporary Workarounds
Input Sanitization
allAdd HTML entity encoding to search parameter before output
$search = htmlspecialchars($_GET['search'], ENT_QUOTES, 'UTF-8');
WAF Rule
allBlock requests containing script tags in search parameter
ModSecurity rule: SecRule ARGS:search "@rx <script" "id:1001,phase:2,deny"
🧯 If You Can't Patch
- Disable search.php functionality if not essential
- Implement strict Content Security Policy to block inline scripts
🔍 How to Verify
Check if Vulnerable:
Access search.php?search=<script>alert('XSS')</script> and check if alert executesCheck Version:
Check system documentation or about page for version informationVerify Fix Applied:
Test same payload and verify no script execution occurs📡 Detection & Monitoring
Log Indicators:
- HTTP requests to search.php with script tags in parameters
- Unusual search patterns with HTML/JavaScript syntax
Network Indicators:
- HTTP requests containing <script> tags in GET parameters
- Multiple rapid requests to search.php with encoded payloads
SIEM Query:
source="web_logs" AND uri="*search.php*" AND (param="*<script>*" OR param="*javascript:*")