CVE-2024-2270: Online Bookstore Website XSS Vulnerability

CVE-2024-2270 Overview

CVE-2024-2270 is a stored cross-site scripting (XSS) vulnerability in the keerti1924 Online-Book-Store-Website 1.0 application. The flaw resides in /signup.php, where the name parameter is not properly sanitized before being stored and rendered. An unauthenticated remote attacker can inject arbitrary JavaScript that executes in the browser of any user who views the affected page. The issue is tracked as VulDB entry VDB-256040 and is classified under [CWE-79]. According to the disclosure, the vendor was contacted but did not respond, and no official patch is available.

Critical Impact
Attackers can plant persistent JavaScript payloads through the signup form, enabling session theft, credential harvesting, and browser-based attacks against any visitor to affected pages.

Affected Products

keerti1924 Online-Book-Store-Website 1.0
CPE: cpe:2.3:a:keerti1924:online_bookstore_website:1.0:*:*:*:*:*:*:*
Vendor: keerti1924 (unresponsive to disclosure)

Discovery Timeline

2024-03-07 - CVE-2024-2270 published to NVD with VulDB identifier VDB-256040
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-2270

Vulnerability Analysis

The vulnerability is a stored XSS in the user registration flow of the Online-Book-Store-Website PHP application. The name field submitted to /signup.php is persisted without output encoding or input filtering. When the stored value is later rendered in HTML contexts, the browser interprets injected <script> payloads as executable code. Because the payload is stored server-side, every subsequent visitor to the affected page triggers execution, distinguishing this from reflected XSS. Exploitation requires user interaction only in the sense that a victim must load a page rendering the malicious name value. The attack is network-reachable, requires no authentication to plant the payload, and impacts confidentiality and integrity of user sessions. A public proof-of-concept is available at the GitHub PoC for Stored XSS.

Root Cause

The root cause is missing input validation and missing output encoding on the name parameter processed by /signup.php. The application accepts arbitrary HTML and JavaScript, stores it in the backend, and later emits it into an HTML context without functions such as htmlspecialchars() or an equivalent contextual encoder.

Attack Vector

An attacker submits a crafted registration request to /signup.php with a JavaScript payload embedded in the name field. The payload is persisted and executed in the browser of any user rendering the stored value, including administrators viewing user records. See the VulDB entry #256040 for additional technical context.

No verified exploit code is reproduced here. Refer to the linked PoC for payload structure and reproduction steps.

Detection Methods for CVE-2024-2270

Indicators of Compromise

HTTP POST requests to /signup.php containing <script>, onerror=, onload=, javascript:, or encoded variants in the name parameter
User records in the application database with name values containing HTML tags or JavaScript syntax
Anomalous outbound requests from user browsers to attacker-controlled domains after visiting pages that render user names
Unexpected cookie or session token transmissions originating from application pages

Detection Strategies

Deploy web application firewall (WAF) rules that inspect the name parameter on /signup.php for script tags, event handlers, and encoded payloads
Review application access logs for signup submissions containing suspicious characters such as <, >, ", ', or %3C
Query the user database for stored values containing HTML or JavaScript syntax and quarantine matching records

Monitoring Recommendations

Monitor endpoints that browse the vulnerable application for unusual JavaScript execution, credential prompts, or redirects
Alert on outbound connections from browser processes to newly observed or low-reputation domains
Track failed and successful signups from a single source address to identify automated payload seeding

How to Mitigate CVE-2024-2270

Immediate Actions Required

Take the affected Online-Book-Store-Website 1.0 instance offline or restrict access to trusted networks until remediation is applied
Audit the user database for existing malicious name values and remove or encode them
Rotate session tokens and force password resets for any accounts that viewed compromised pages

Patch Information

No official vendor patch is available. The disclosure notes the vendor did not respond to contact attempts. Operators must apply source-level fixes: sanitize the name input using an allow-list of characters and encode all user-supplied values on output with htmlspecialchars($value, ENT_QUOTES, 'UTF-8') or an equivalent contextual encoder. Track the VulDB CTI entry #256040 for any updates.

Workarounds

Place the application behind a WAF with rules blocking XSS payloads in the name parameter
Implement a strict Content Security Policy (CSP) header disallowing inline scripts and restricting script sources
Set the HttpOnly and Secure flags on session cookies to reduce impact of successful script execution
Consider migrating to a maintained e-commerce or bookstore platform, as the affected project appears unmaintained

bash

# Example NGINX Content Security Policy header to reduce XSS impact
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'none'" always;
add_header X-XSS-Protection "1; mode=block" always;
add_header X-Content-Type-Options "nosniff" always;