CVE-2024-2145 Overview
CVE-2024-2145 is a stored cross-site scripting (XSS) vulnerability in SourceCodester Online Mobile Management Store 1.0. The flaw exists in the /endpoint/update-tracker.php file, where the firstname parameter is not properly sanitized before rendering. Remote attackers can inject arbitrary JavaScript that executes in the context of any user who views the affected page. The exploit has been publicly disclosed and is tracked as VDB-255498 by VulDB. The weakness is classified under CWE-79: Improper Neutralization of Input During Web Page Generation.
Critical Impact
Attackers can inject persistent JavaScript payloads through the firstname parameter, enabling session hijacking, credential theft, and unauthorized actions against authenticated administrators.
Affected Products
- Oretnom23 (SourceCodester) Online Mobile Store Management System 1.0
- Component: /endpoint/update-tracker.php
- Vulnerable parameter: firstname
Discovery Timeline
- 2024-03-03 - CVE-2024-2145 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-2145
Vulnerability Analysis
The vulnerability resides in the update-tracker.php endpoint of the Online Mobile Store Management System. The application accepts user-supplied input through the firstname parameter and stores it without applying output encoding or input validation. When the stored value is later rendered in an HTML context, any embedded script tags execute in the browser of the viewing user.
Because the payload persists in the application database, this is a stored (persistent) XSS rather than a reflected variant. Every subsequent visit to the affected view triggers script execution. Administrators reviewing tracker records are the most likely victims, which raises the practical impact beyond a single-user session.
Exploitation requires no authentication depending on endpoint exposure, and the attack vector is remote over the network. User interaction is required to trigger the payload, since a victim must load the page that renders the stored value.
Root Cause
The root cause is missing input sanitization and output encoding on the firstname field in /endpoint/update-tracker.php. The application trusts client-supplied data and writes it back into HTML responses verbatim. There is no Content Security Policy (CSP) or contextual escaping to neutralize embedded markup.
Attack Vector
An attacker submits a crafted request to /endpoint/update-tracker.php with a JavaScript payload placed in the firstname parameter. The malicious value is persisted in the backend datastore. When a legitimate user, typically a store administrator, opens the record management view, the browser parses the stored markup and executes the attacker's script under the site's origin.
See the public technical writeup on GitHub and the VulDB entry #255498 for reproduction details.
Detection Methods for CVE-2024-2145
Indicators of Compromise
- HTTP POST requests to /endpoint/update-tracker.php containing <script>, onerror=, onload=, or javascript: substrings in the firstname parameter.
- Unusual outbound requests from administrator browsers to attacker-controlled domains shortly after loading tracker pages.
- Database records in the tracker or customer tables containing HTML or JavaScript syntax inside name fields.
Detection Strategies
- Deploy a web application firewall (WAF) rule that inspects the firstname parameter for HTML tags and event-handler patterns before it reaches the application.
- Review web server access logs for POST /endpoint/update-tracker.php requests with encoded or obfuscated script payloads.
- Run periodic database queries to identify persisted values containing <, >, or common XSS keywords in text fields.
Monitoring Recommendations
- Alert on administrator sessions issuing anomalous requests immediately after opening tracker views, which may indicate session token theft.
- Monitor for new or unexpected cookies, local storage entries, or DOM modifications on pages that render tracker data.
- Correlate suspicious authentication events with prior visits to pages rendering user-controlled firstname values.
How to Mitigate CVE-2024-2145
Immediate Actions Required
- Restrict network access to the Online Mobile Store Management System until the input handling in update-tracker.php is remediated.
- Audit the tracker database table and remove or sanitize any stored values that contain HTML markup or JavaScript.
- Enforce administrator re-authentication and rotate session cookies to invalidate any tokens that may have been captured.
Patch Information
No official vendor patch has been published for SourceCodester Online Mobile Store Management System 1.0. Because upstream fixes are not available, operators must apply source-level mitigations or discontinue use of the affected application. Consult the VulDB advisory for the latest status.
Workarounds
- Modify /endpoint/update-tracker.php to apply contextual output encoding using PHP's htmlspecialchars($value, ENT_QUOTES, 'UTF-8') before rendering firstname.
- Add server-side input validation that rejects any firstname value containing angle brackets, quotes, or event-handler tokens.
- Deploy a strict Content Security Policy header such as Content-Security-Policy: default-src 'self'; script-src 'self' to limit the impact of injected scripts.
- Place the application behind a WAF with OWASP Core Rule Set XSS signatures enabled.
# Example Apache header configuration to add a restrictive CSP
Header always set Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'"
Header always set X-Content-Type-Options "nosniff"
Header always set X-Frame-Options "DENY"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
