CVE-2024-1196: Testimonial Page Manager XSS Vulnerability

CVE-2024-1196 Overview

CVE-2024-1196 is a reflected cross-site scripting (XSS) vulnerability in SourceCodester Testimonial Page Manager 1.0. The flaw resides in add-testimonial.php within the HTTP POST request handler. Attackers can inject malicious script payloads through the name, description, or testimony parameters. When the injected content is rendered in a browser, the payload executes in the victim's session context. The vulnerability is remotely exploitable and requires user interaction to trigger. It is tracked under VulDB identifier VDB-252694 and mapped to CWE-79.

Critical Impact
Remote attackers can execute arbitrary JavaScript in the browsers of users viewing the affected testimonial page, enabling session theft, credential harvesting, and defacement.

Affected Products

SourceCodester Testimonial Page Manager 1.0
Vendor: remyandrade
Vulnerable component: add-testimonial.php (HTTP POST Request Handler)

Discovery Timeline

2024-02-02 - CVE-2024-1196 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-1196

Vulnerability Analysis

The application fails to sanitize or encode user-supplied input submitted through the add-testimonial.php endpoint. The name, description, and testimony POST parameters accept arbitrary characters, including HTML and JavaScript. Submitted values are later rendered in the testimonial listing without output encoding.

An attacker crafts a testimonial containing a JavaScript payload and submits it through the public form. When an administrator or visitor loads the page displaying the testimonial, the injected script executes in the browser. The stored variant allows persistent execution against any user who views the affected page.

The issue falls under the classic input validation and output encoding failure pattern described by CWE-79. The current EPSS probability is 0.481%.

Root Cause

The root cause is missing input validation and missing output encoding in the testimonial submission workflow. The application trusts user-supplied POST data and writes it directly into server-rendered HTML. No context-aware escaping is applied before the values reach the DOM.

Attack Vector

Exploitation requires network access to the testimonial submission endpoint and user interaction to view the rendered page. An attacker submits a POST request to add-testimonial.php containing a script payload in one or more of the vulnerable parameters. When a victim loads the testimonial page, the payload executes with the site's origin privileges, enabling cookie theft, session hijacking, or forced browser actions. Refer to the VulDB advisory for additional technical details.

Detection Methods for CVE-2024-1196

Indicators of Compromise

POST requests to add-testimonial.php containing <script>, onerror=, onload=, or javascript: substrings in the name, description, or testimony parameters.
Database rows in the testimonials table containing HTML tags or JavaScript event handlers.
Unexpected outbound requests from user browsers to attacker-controlled domains after visiting the testimonial page.

Detection Strategies

Deploy a Web Application Firewall (WAF) rule that inspects POST bodies to add-testimonial.php for common XSS payload signatures.
Review web server access logs for anomalous POST requests to the testimonial endpoint originating from a small set of source IPs with unusual payload sizes.
Perform periodic content audits of stored testimonial entries for HTML or script markup.

Monitoring Recommendations

Enable and monitor Content Security Policy (CSP) violation reports for inline script executions on pages that render testimonials.
Alert on browser console errors or CSP blocks recorded through client-side telemetry.
Track spikes in submissions to add-testimonial.php from single IP addresses or automated user agents.

How to Mitigate CVE-2024-1196

Immediate Actions Required

Restrict public access to add-testimonial.php until a fix is applied, using authentication or an IP allowlist.
Sanitize existing testimonial records by stripping HTML tags and JavaScript event handlers from stored name, description, and testimony values.
Deploy a strict Content Security Policy that disallows inline scripts to reduce exploitation impact.

Patch Information

No official vendor patch is listed in the NVD or VulDB references at the time of publication. Consult the VulDB entry for updates on remediation status. Organizations running SourceCodester Testimonial Page Manager 1.0 should treat the application as unmaintained and consider migrating to a supported alternative.

Workarounds

Apply server-side input validation that rejects payloads containing <, >, or javascript: in the vulnerable parameters.
Apply context-aware output encoding (HTML entity encoding) when rendering testimonial fields in server templates.
Place the application behind a WAF configured with OWASP Core Rule Set XSS signatures.
Set the HttpOnly and Secure flags on session cookies to limit script access to authentication tokens.

bash

# Example ModSecurity rule to block script tags in testimonial submissions
SecRule REQUEST_URI "@endsWith /add-testimonial.php" \
    "id:1001960,phase:2,deny,status:403,\
    chain,msg:'Blocked XSS attempt on Testimonial Page Manager'"
    SecRule ARGS:name|ARGS:description|ARGS:testimony \
        "@rx (?i)(<script|onerror=|onload=|javascript:)"