CVE-2024-0503: Online FIR System XSS Vulnerability

CVE-2024-0503 Overview

CVE-2024-0503 is a reflected cross-site scripting (XSS) vulnerability in code-projects Online FIR System 1.0. The flaw resides in registercomplaint.php, where the Name and Address request parameters are rendered back to users without adequate output encoding. Attackers can inject JavaScript payloads into these fields and execute arbitrary script in the browser of any user who processes the crafted input. The issue was assigned the internal identifier VDB-250611 and is exploitable remotely without authentication, though it requires user interaction to trigger. A public disclosure includes exploitation details, increasing the likelihood of opportunistic abuse against exposed deployments.

Critical Impact
Successful exploitation allows attackers to execute arbitrary JavaScript in a victim's browser session, enabling session token theft, credential harvesting through injected forms, and unauthorized actions performed as the affected user.

Affected Products

code-projects Online FIR System 1.0
registercomplaint.php component
Deployments exposing the Name and Address input parameters

Discovery Timeline

2024-01-13 - CVE-2024-0503 published to the National Vulnerability Database
2026-06-17 - Last updated in the NVD database

Technical Details for CVE-2024-0503

Vulnerability Analysis

The vulnerability is a reflected cross-site scripting flaw classified under [CWE-79]. The registercomplaint.php script accepts user-supplied values for the Name and Address parameters and echoes them back into the HTTP response without proper HTML entity encoding or contextual output escaping.

An attacker crafts a URL or complaint submission containing JavaScript within these fields. When the response is rendered, the browser interprets the injected markup as active content. Because the attack occurs in the context of the vulnerable application, the malicious script inherits the origin's privileges.

Exploitation supports typical XSS impact scenarios: session cookie exfiltration, phishing overlays served from the trusted domain, forced state-changing requests, and redirection to attacker-controlled infrastructure. The scope change indicator in the CVSS vector reflects the ability of the injected script to affect resources beyond the vulnerable component.

Root Cause

The root cause is missing input sanitization and output encoding on the Name and Address parameters handled by registercomplaint.php. The application concatenates untrusted data directly into HTML output, allowing script tags and event handlers to reach the DOM intact.

Attack Vector

An attacker delivers a crafted link or form submission targeting the FIR registration endpoint. The victim must interact with the malicious content, for example by clicking a phishing link, at which point the injected payload executes in their browser session against the vulnerable Online FIR System instance.

See the VulDB entry for VDB-250611 and the associated Google Drive proof-of-concept document for the disclosed exploitation details.

Detection Methods for CVE-2024-0503

Indicators of Compromise

HTTP requests to registercomplaint.php containing <script>, onerror=, onload=, javascript:, or encoded variants (%3Cscript%3E) in the Name or Address parameters.
Outbound browser requests from user sessions to unrecognized domains immediately after visiting the FIR complaint page.
Web server access logs showing unusually long query strings or URL-encoded HTML metacharacters posted to the complaint endpoint.

Detection Strategies

Deploy Web Application Firewall (WAF) rules to flag HTML and JavaScript metacharacters submitted to registercomplaint.php parameters.
Enable server-side logging of full request bodies for the complaint registration endpoint and alert on payloads matching known XSS signatures.
Correlate reflected response bodies with request parameters to identify unescaped user input reaching the DOM.

Monitoring Recommendations

Monitor authenticated administrator sessions for anomalous actions taken shortly after viewing user-submitted complaints.
Track browser Content Security Policy (CSP) violation reports if CSP headers are deployed.
Review referrer logs for external sites that link into the complaint registration workflow with suspicious parameters.

How to Mitigate CVE-2024-0503

Immediate Actions Required

Restrict public access to the Online FIR System 1.0 deployment until a patched or hardened build is available.
Deploy a WAF policy that blocks HTML and script metacharacters in the Name and Address parameters of registercomplaint.php.
Instruct administrators and case handlers to avoid clicking untrusted links referencing the complaint registration endpoint.

Patch Information

No vendor patch is referenced in the NVD entry or the disclosed VulDB record for CVE-2024-0503. Operators should apply application-layer input validation and output encoding, or migrate away from the unmaintained release. Consult the VulDB advisory for updates on remediation status.

Workarounds

Implement server-side HTML entity encoding on all values reflected from the Name and Address parameters before rendering them in responses.
Add a strict Content Security Policy that disallows inline scripts and restricts script sources to trusted origins to limit XSS impact.
Configure the session cookie with HttpOnly and SameSite=Strict attributes to reduce the value of stolen tokens.
Apply input allowlisting on user-supplied name and address fields to reject characters not required for legitimate submissions.

bash

# Example nginx WAF-style rule to block obvious XSS payloads on the complaint endpoint
location /registercomplaint.php {
    if ($args ~* "(<|%3C)script|onerror=|onload=|javascript:") {
        return 403;
    }
}