CVE-2024-0345: Vehicle Booking System XSS Vulnerability

CVE-2024-0345 Overview

CVE-2024-0345 is a reflected cross-site scripting (XSS) vulnerability [CWE-79] in CodeAstro Vehicle Booking System 1.0. The flaw resides in the usr/usr-register.php file within the User Registration component. Attackers can inject arbitrary JavaScript through the Full_Name, Last_Name, or Address parameters during account registration.

The vulnerability requires user interaction but no authentication, and it is exploitable remotely over the network. Public disclosure of a working exploit under the identifier VDB-250113 increases the likelihood of opportunistic attacks against exposed installations.

Critical Impact
Attackers can execute arbitrary JavaScript in the browsers of victims who interact with maliciously crafted registration data, enabling session cookie theft, credential harvesting, and account takeover.

Affected Products

CodeAstro Vehicle Booking System 1.0
usr/usr-register.php User Registration component
Deployments exposing the registration workflow to untrusted users

Discovery Timeline

2024-01-09 - CVE-2024-0345 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-0345

Vulnerability Analysis

The vulnerability is a reflected cross-site scripting flaw in the user registration workflow of CodeAstro Vehicle Booking System 1.0. The application fails to sanitize or encode user-supplied input submitted through the registration form before rendering it back in HTTP responses.

An attacker supplies JavaScript payloads such as <script>alert(document.cookie)</script> in the Full_Name, Last_Name, or Address fields. The server reflects the raw input into the HTML response, causing the browser to execute the injected script within the site's origin.

Successful exploitation allows an attacker to steal session cookies, hijack authenticated sessions, or perform actions on behalf of the victim within the application. The public availability of the exploit lowers the barrier for adversaries.

Root Cause

The root cause is missing input validation and output encoding in usr/usr-register.php. The application concatenates user-controlled input directly into HTML output without applying context-aware escaping. This maps to [CWE-79], Improper Neutralization of Input During Web Page Generation.

Attack Vector

The attack vector is network-based and requires user interaction. An attacker crafts a malicious registration request or a link that submits payload data to the vulnerable endpoint. When a victim, such as an administrator reviewing registrations, loads the reflected content, the injected script executes in their browser context.

The vulnerability manifests in the registration handler. See the VulDB Analysis #250113 and technical writeup for reproduction details.

Detection Methods for CVE-2024-0345

Indicators of Compromise

HTTP POST requests to usr/usr-register.php containing <script>, javascript:, or event handler patterns such as onerror= in the Full_Name, Last_Name, or Address parameters.
Web server access logs showing URL-encoded XSS payloads (for example %3Cscript%3E) targeting the registration endpoint.
Unexpected outbound requests from administrator browsers to attacker-controlled domains shortly after viewing registered user records.

Detection Strategies

Deploy a web application firewall (WAF) with signatures for reflected XSS patterns on registration and profile endpoints.
Review application logs for anomalous field values containing HTML tags or script keywords submitted during registration.
Correlate browser-side content security policy (CSP) violation reports with server-side registration events to identify injection attempts.

Monitoring Recommendations

Alert on repeated failed registration attempts from a single source with payloads resembling script injection.
Monitor administrative user sessions for anomalous cookie access patterns or unexpected DOM interactions following registration reviews.
Track EPSS trend data for CVE-2024-0345, currently reflecting elevated exploit activity in public trackers.

How to Mitigate CVE-2024-0345

Immediate Actions Required

Restrict public access to usr/usr-register.php via network controls or authentication until remediation is applied.
Deploy WAF rules that block HTML and script metacharacters in registration parameters Full_Name, Last_Name, and Address.
Instruct administrators to avoid viewing untrusted registration entries in a browser session that holds privileged cookies.

Patch Information

No vendor-supplied patch is referenced in the enriched CVE data. Organizations should contact CodeAstro directly for a fixed release or apply source-level fixes: validate input against an allowlist and apply context-aware output encoding (for example, HTML entity encoding) before rendering user-supplied fields. Review the VulDB entry for updates.

Workarounds

Implement server-side input validation rejecting characters such as <, >, ", and ' in registration fields.
Apply HTML entity encoding to all user-supplied fields before rendering them in any HTML context.
Enforce a strict Content Security Policy (CSP) that disallows inline scripts and restricts script sources to trusted origins.
Set the HttpOnly and Secure flags on session cookies to reduce impact of cookie theft via XSS.

bash

# Example CSP header configuration to mitigate reflected XSS
Header set Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'none'"
Header set X-XSS-Protection "1; mode=block"
Header edit Set-Cookie ^(.*)$ $1;HttpOnly;Secure;SameSite=Strict