CVE-2024-2146: Online Mobile Store Management System XSS

CVE-2024-2146 Overview

CVE-2024-2146 is a reflected cross-site scripting (XSS) vulnerability in SourceCodester Online Mobile Management Store 1.0, developed by oretnom23. The flaw resides in the /?p=products endpoint, where the search parameter is reflected in the response without proper output encoding. An unauthenticated remote attacker can craft a malicious URL that executes arbitrary JavaScript in the victim's browser when clicked. The issue is classified under [CWE-79] (Improper Neutralization of Input During Web Page Generation). The exploit details have been publicly disclosed through VulDB entry 255499 and a GitHub proof-of-concept writeup.

Critical Impact
Attackers can hijack sessions, steal credentials, or deliver drive-by payloads by tricking authenticated users into clicking crafted links targeting the search parameter.

Affected Products

Oretnom23 Online Mobile Store Management System 1.0
SourceCodester Online Mobile Management Store 1.0
CPE: cpe:2.3:a:oretnom23:online_mobile_store_management_system:1.0

Discovery Timeline

2024-03-03 - CVE-2024-2146 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-2146

Vulnerability Analysis

The vulnerability affects the product listing page at /?p=products. The application accepts a search query parameter and renders its value directly into the returned HTML. Because the server-side code fails to sanitize or HTML-encode the input, attacker-controlled markup and script tags are executed by the browser as part of the response.

Reflected XSS requires user interaction, typically through a crafted link delivered via phishing, instant messaging, or malvertising. Once executed, the injected JavaScript runs in the origin of the vulnerable application. This allows the attacker to read cookies not protected by HttpOnly, perform actions on behalf of the user, exfiltrate form data, or pivot to further client-side attacks against the admin console.

Root Cause

The root cause is missing input validation and output encoding on the search GET parameter processed by /?p=products. User input is concatenated into HTML output without passing through an encoding routine such as htmlspecialchars() with ENT_QUOTES. The application also lacks a Content Security Policy (CSP) that would restrict inline script execution.

Attack Vector

The attack vector is network-based and requires user interaction. An attacker constructs a URL in the form http://victim-host/?p=products&search=<payload>, where <payload> contains a JavaScript event handler or <script> tag. Delivery relies on social engineering, since the victim must load the URL in an authenticated session for high-impact outcomes. Technical details and the proof-of-concept are documented in the GitHub CVE Dumps writeup and the VulDB entry 255499.

Detection Methods for CVE-2024-2146

Indicators of Compromise

Web server access logs containing requests to /?p=products with search values that include <script, onerror=, onload=, javascript:, or encoded variants such as %3Cscript.
Outbound HTTP requests from user browsers to attacker-controlled domains originating from the application's origin.
Unexpected session cookie reuse from distinct IP addresses following a suspicious URL click.

Detection Strategies

Deploy a web application firewall (WAF) rule set, such as OWASP ModSecurity CRS, to flag reflected XSS payloads targeting the search parameter.
Enable server-side logging of full query strings and inspect them for HTML entities, angle brackets, and JavaScript keywords in the search field.
Correlate browser-side CSP violation reports with web server logs to identify blocked injection attempts.

Monitoring Recommendations

Alert on spikes in 4xx or 5xx responses from /?p=products paired with long or encoded search values.
Monitor admin and staff account activity for anomalous actions immediately following access to crafted product search URLs.
Review phishing telemetry and email gateways for links referencing the vulnerable endpoint.

How to Mitigate CVE-2024-2146

Immediate Actions Required

Restrict external access to the Online Mobile Store Management System until a patched build is deployed, or place it behind an authenticated VPN.
Deploy WAF rules that block reflected XSS payloads in the search parameter on /?p=products.
Rotate administrative session cookies and credentials if suspicious URL access has been observed.

Patch Information

No vendor advisory or official patch has been published for CVE-2024-2146 at the time of writing. Operators should track the VulDB CTI entry for updates and consider applying source-level fixes to encode the search parameter using htmlspecialchars($_GET['search'], ENT_QUOTES, 'UTF-8') before rendering.

Workarounds

Add server-side input validation that rejects or strips HTML metacharacters from the search parameter.
Enforce a strict Content Security Policy that disallows inline scripts and restricts script sources to trusted origins.
Set the HttpOnly and Secure flags on all session cookies to limit the impact of successful script execution.
Educate users and administrators to avoid clicking unsolicited links that reference the application's product search URL.

bash

# Example nginx header hardening to reduce XSS impact
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'" always;
add_header X-Content-Type-Options "nosniff" always;
add_header Referrer-Policy "no-referrer" always;
add_header Set-Cookie "PHPSESSID=$cookie_PHPSESSID; HttpOnly; Secure; SameSite=Strict";