CVE-2024-2285: Automated-Mess-Management-System XSS Flaw

CVE-2024-2285 Overview

CVE-2024-2285 is a stored cross-site scripting (XSS) vulnerability in Boyiddha Automated-Mess-Management-System 1.0. The flaw resides in the /member/member_edit.php file, where the name parameter is not properly sanitized before being rendered in the application. An unauthenticated attacker can inject arbitrary JavaScript that executes in the browser context of any user who views the affected member record. The vulnerability is remotely exploitable and requires user interaction. The vendor was contacted about this disclosure but did not respond, and no official patch is available. This issue is tracked in VulDB as entry 256052.

Critical Impact
Attackers can inject persistent JavaScript into member records, enabling session hijacking, credential theft, and unauthorized actions against users of the mess management application.

Affected Products

Boyiddha Automated-Mess-Management-System version 1.0
Component: /member/member_edit.php
Vulnerable parameter: name

Discovery Timeline

2024-03-08 - CVE-2024-2285 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-2285

Vulnerability Analysis

CVE-2024-2285 is classified under [CWE-79], Improper Neutralization of Input During Web Page Generation. The application accepts user-supplied input through the name parameter in /member/member_edit.php and stores it without applying output encoding or input sanitization. When the affected record is later rendered in a browser, the attacker-supplied payload executes as JavaScript within the victim's session context.

Because the payload is persisted server-side, every user who visits the affected page triggers execution. This makes the stored variant more damaging than reflected XSS, since exploitation does not depend on tricking a specific user into clicking a crafted link. Attackers can leverage the flaw to steal session cookies, perform actions on behalf of authenticated users, deface content, or pivot to internal administrative functions if higher-privileged accounts view the injected data.

Root Cause

The root cause is missing input validation and output encoding on the name field processed by member_edit.php. The PHP endpoint writes attacker-controlled data directly into the underlying data store and reflects it back into HTML responses without contextual escaping such as htmlspecialchars(). Any HTML or JavaScript metacharacters remain intact through the store-and-render pipeline.

Attack Vector

Exploitation occurs over the network with no privileges required, though the payload executes only when a user renders the affected member page. An attacker submits a request to /member/member_edit.php containing a malicious value in the name parameter, for example an HTML <script> tag or an event handler such as onerror. The payload is stored in the application database and executes in the browser of any subsequent viewer. Additional technical detail is available in the GitHub PoC Repository and the VulDB entry #256052.

Detection Methods for CVE-2024-2285

Indicators of Compromise

HTTP POST or GET requests to /member/member_edit.php containing <script>, onerror=, onload=, or javascript: substrings in the name parameter.
Member records in the application database whose name field contains HTML tags, event handlers, or encoded script payloads.
Outbound browser requests to attacker-controlled domains originating from user sessions that viewed a member edit page.

Detection Strategies

Deploy web application firewall (WAF) rules that inspect the name parameter on /member/member_edit.php for XSS signatures and encoded variants.
Perform periodic database audits of the members table for stored HTML or script content that should not appear in a plain-text name field.
Review web server access logs for anomalous POST bodies targeting the member_edit.php endpoint from unauthenticated sources.

Monitoring Recommendations

Enable Content Security Policy (CSP) reporting to identify inline script execution attempts blocked by policy.
Monitor authenticated session activity for unexpected cookie access, token exfiltration, or requests initiated shortly after loading a member page.
Correlate WAF alerts with endpoint telemetry to identify browsers that rendered malicious payloads and may require session invalidation.

How to Mitigate CVE-2024-2285

Immediate Actions Required

Restrict network exposure of the Automated-Mess-Management-System application, placing it behind authenticated access and a WAF with XSS filtering enabled.
Audit the members table for stored payloads and sanitize or remove any records containing HTML or script content.
Rotate active session tokens and force re-authentication for any users who may have viewed compromised records.

Patch Information

No official patch is available. The vendor was contacted prior to disclosure but did not respond. Organizations relying on Boyiddha Automated-Mess-Management-System 1.0 should apply source-level fixes by encoding output with htmlspecialchars($value, ENT_QUOTES, 'UTF-8') on any rendering of the name field and validating input server-side before persistence. Refer to the VulDB advisory #256052 for tracking updates.

Workarounds

Apply a virtual patch at the WAF layer to reject requests where name contains angle brackets, script tags, or common event handler keywords.
Modify member_edit.php locally to invoke htmlspecialchars() on all reflected fields and enforce allow-list validation on the name parameter.
Deploy a strict Content Security Policy that disallows inline scripts and restricts script sources to trusted origins.
Consider migrating to a maintained mess management application if the vendor remains unresponsive to security disclosures.

bash

# Example Apache mod_security rule to block obvious XSS payloads on the vulnerable endpoint
SecRule REQUEST_URI "@streq /member/member_edit.php" \
  "phase:2,chain,deny,status:403,id:1002285,msg:'Block XSS attempt on member_edit.php name parameter'"
  SecRule ARGS:name "@rx (?i)(<script|onerror=|onload=|javascript:)" "t:none,t:urlDecodeUni"