CVE-2024-0650: Visitor Management System XSS Vulnerability

CVE-2024-0650 Overview

CVE-2024-0650 is a reflected cross-site scripting (XSS) vulnerability in Projectworlds Visitor Management System 1.0. The flaw resides in the dataset.php file within the URL Handler component. Attackers can inject arbitrary JavaScript by manipulating the name parameter, which the application reflects into responses without proper output encoding. The issue is remotely exploitable and requires user interaction, such as clicking a crafted link. Public disclosure occurred through VulDB entry VDB-251376, and proof-of-concept payloads are already circulating.

Critical Impact
Attackers can execute arbitrary JavaScript in the context of an authenticated visitor management session, enabling session theft, credential harvesting, and unauthorized actions on behalf of the victim.

Affected Products

Projectworlds Visitor Management System 1.0
Component: dataset.php URL Handler
CPE: cpe:2.3:a:projectworlds:visitor_management_system:1.0

Discovery Timeline

2024-01-18 - CVE-2024-0650 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-0650

Vulnerability Analysis

CVE-2024-0650 is classified as Cross-Site Scripting under [CWE-79]. The vulnerability originates in dataset.php, where the name GET parameter is written directly into the HTML response. Because the application performs no HTML entity encoding or input filtering, arbitrary markup and script tags execute in the victim's browser.

Exploitation requires the victim to visit a crafted URL supplied by the attacker. Once triggered, the injected script runs under the origin of the vulnerable application. This exposes session cookies, cross-site request forgery (CSRF) tokens, and any data reachable through the Document Object Model.

The VulDB proof-of-concept demonstrates the flaw using a simple payload of the form "><script>alert('torada')</script> supplied to the name argument. Attackers can substitute payloads that exfiltrate cookies or perform authenticated actions.

Root Cause

The root cause is missing output encoding on user-controlled input reflected by dataset.php. The application accepts the name parameter from the query string and inserts it into the rendered page without sanitization. Any breakout characters, including <, >, and ", remain intact in the response.

Attack Vector

The attack vector is network-based and requires user interaction. An attacker crafts a URL targeting the vulnerable endpoint with an injected script payload in the name parameter. Delivery typically occurs through phishing emails, malicious links on forums, or attacker-controlled sites. When the victim loads the URL, the reflected payload executes in their browser session.

The vulnerability manifests in the URL handler for dataset.php. See the Notion XSS Vulnerability Report and VulDB #251376 for the disclosed proof-of-concept.

Detection Methods for CVE-2024-0650

Indicators of Compromise

HTTP requests to dataset.php containing <script>, onerror=, onload=, or URL-encoded variants such as %3Cscript%3E in the name parameter.
Web server access logs showing referrers from untrusted domains delivering crafted links to dataset.php.
Browser telemetry recording script execution from unexpected inline sources within the Visitor Management System origin.

Detection Strategies

Deploy a web application firewall (WAF) rule that blocks or alerts on script tags, event handlers, and encoded XSS payloads in query parameters targeting dataset.php.
Enable server-side request logging with full query string capture and analyze parameters for known XSS signatures.
Correlate outbound requests from user browsers to suspicious domains shortly after visits to the Visitor Management System.

Monitoring Recommendations

Monitor authentication and session activity for anomalies such as session reuse from unexpected IP addresses following a click on an external link.
Alert on Content Security Policy (CSP) violation reports if a policy is deployed in report-only mode.
Review web proxy logs for repeated requests to dataset.php with unusual name parameter content.

How to Mitigate CVE-2024-0650

Immediate Actions Required

Restrict access to the Visitor Management System to trusted networks or place it behind a VPN until a patch is available.
Deploy WAF rules that block XSS payload patterns in the name parameter of dataset.php.
Educate users to avoid clicking unsolicited links referencing the Visitor Management System.

Patch Information

No vendor patch has been published in the referenced advisories. Projectworlds has not issued a fixed release for Visitor Management System 1.0 in the vendor resources listed for this CVE. Organizations should track the VulDB entry for updates and consider replacing the application if remediation is not forthcoming.

Workarounds

Implement server-side output encoding by wrapping any reflection of the name parameter with an HTML entity encoder before rendering.
Deploy a strict Content Security Policy that disallows inline scripts and restricts script sources to trusted origins.
Enable HttpOnly and Secure flags on session cookies to limit the impact of script-based session theft.
If source code access is available, sanitize input in dataset.php using an allowlist for expected characters in the name parameter.

bash

# Example WAF rule (ModSecurity) to block reflected XSS on dataset.php
SecRule REQUEST_URI "@contains /dataset.php" \
  "chain,phase:2,deny,status:403,id:1002024065,\
   msg:'CVE-2024-0650 XSS attempt on dataset.php'"
  SecRule ARGS:name "@rx (?i)(<script|onerror=|onload=|javascript:|%3Cscript)" \
    "t:none,t:urlDecodeUni"