CVE-2024-7321
📋 TL;DR
This vulnerability allows attackers to inject malicious scripts into the 'user' parameter of the signup.php file in Online Blood Bank Management System 1.0. When victims view pages containing the injected scripts, the attacker can steal session cookies, redirect users, or perform actions on their behalf. This affects all deployments of version 1.0 of this specific blood bank management system.
💻 Affected Systems
- itsourcecode Online Blood Bank Management System
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers steal administrator session cookies, gain full system access, compromise donor/patient data, and potentially pivot to other systems.
Likely Case
Attackers steal user session cookies to hijack accounts, deface pages, or redirect users to malicious sites.
If Mitigated
Scripts execute but cannot access sensitive data due to proper Content Security Policy and cookie security flags.
🎯 Exploit Status
Exploit details are publicly available on GitHub. Attack requires user interaction (viewing malicious page) but no authentication to inject payloads.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None found
Restart Required: No
Instructions:
No official patch available. Implement workarounds or consider replacing the software.
🔧 Temporary Workarounds
Input Sanitization
allAdd proper input validation and output encoding to signup.php to sanitize the 'user' parameter
Edit signup.php and add: $user = htmlspecialchars($_POST['user'], ENT_QUOTES, 'UTF-8');
Content Security Policy
allImplement strict Content Security Policy headers to prevent script execution
Add to .htaccess: Header set Content-Security-Policy "default-src 'self'; script-src 'self'"
Or add to PHP: header("Content-Security-Policy: default-src 'self'; script-src 'self'");
🧯 If You Can't Patch
- Disable user registration functionality by removing/renaming signup.php
- Implement web application firewall (WAF) rules to block XSS payloads in user parameter
🔍 How to Verify
Check if Vulnerable:
Test by submitting <script>alert('XSS')</script> in the user registration field and check if script executes on subsequent pagesCheck Version:
Check version in system documentation, about page, or readme filesVerify Fix Applied:
Test with same payload - script should appear as plain text, not execute📡 Detection & Monitoring
Log Indicators:
- Unusual script tags in user registration POST requests
- Multiple failed registration attempts with script-like content
Network Indicators:
- HTTP requests to signup.php containing <script> tags or javascript: URIs
SIEM Query:
source="web_logs" AND uri="/signup.php" AND (body CONTAINS "<script>" OR body CONTAINS "javascript:")