CVE-2024-2518: Online Event Hall Reservation System XSS

CVE-2024-2518 Overview

CVE-2024-2518 is a reflected cross-site scripting (XSS) vulnerability [CWE-79] in the MAGESH-K21 Online-College-Event-Hall-Reservation-System version 1.0. The flaw resides in book_history.php, where the id parameter is reflected into the response without proper sanitization or output encoding. An unauthenticated remote attacker can craft a malicious URL that, when opened by a victim, executes arbitrary JavaScript in the victim's browser context. The vendor was contacted about this disclosure but did not respond, and no vendor patch has been published. Public exploitation details are available through VulDB entry #256955 and a GitHub proof-of-concept.

Critical Impact
Attackers can execute arbitrary JavaScript in a victim's browser session, enabling session token theft, credential harvesting through injected forms, and unauthorized actions performed on behalf of the authenticated user.

Affected Products

MAGESH-K21 Online-College-Event-Hall-Reservation-System 1.0
Component: book_history.php
Parameter: id

Discovery Timeline

2024-03-16 - CVE-2024-2518 published to NVD with VulDB identifier #256955
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-2518

Vulnerability Analysis

The vulnerability is a reflected XSS flaw in the book_history.php script of the Online-College-Event-Hall-Reservation-System. User-supplied data in the id query parameter is echoed back into the HTML response without sanitization or context-appropriate encoding. Because the payload is delivered through the URL and returned in the immediate response, exploitation requires a victim to follow an attacker-crafted link. Successful exploitation runs attacker JavaScript within the origin of the vulnerable application, giving the attacker access to any data the browser holds for that origin.

The issue is classified under CWE-79: Improper Neutralization of Input During Web Page Generation. The scope change reflected in the CVSS vector indicates the injected script can affect resources beyond the vulnerable component, such as the user's authenticated session state. The EPSS probability sits at 0.468%, indicating low but non-zero likelihood of near-term exploitation activity.

Root Cause

The application fails to apply input validation or output encoding when rendering the id parameter back into the page. PHP applications must apply context-aware escaping using functions such as htmlspecialchars() before writing user input into HTML output. The absence of that encoding step allows raw HTML and JavaScript to break out of the intended data context.

Attack Vector

Exploitation is network-based and requires user interaction. An attacker crafts a URL of the form book_history.php?id=<payload> containing a JavaScript payload and delivers it to the victim through phishing, forum posts, or other social channels. When the victim's browser loads the URL, the reflected payload executes in the application origin. See the published GitHub proof-of-concept for the exact payload structure demonstrated by the reporter.

// No verified exploit code is republished here.
// Refer to the linked VulDB entry and GitHub PoC for technical detail.

Detection Methods for CVE-2024-2518

Indicators of Compromise

Web server access logs showing requests to book_history.php with id parameter values containing HTML tags, <script>, javascript:, onerror=, or URL-encoded equivalents such as %3Cscript%3E.
Outbound requests from user browsers to attacker-controlled domains shortly after loading book_history.php.
Referrer headers containing suspicious or unfamiliar external URLs preceding requests to the reservation system.

Detection Strategies

Deploy a web application firewall (WAF) rule set that flags reflected XSS payloads targeting the id query parameter on book_history.php.
Review historical access logs for payload patterns matching common XSS vectors delivered through GET requests.
Enable Content Security Policy (CSP) violation reporting to surface script execution from unauthorized origins.

Monitoring Recommendations

Aggregate HTTP request logs into a centralized platform and alert on GET parameters containing angle brackets or script keywords.
Track user session anomalies, including unexpected cookie access patterns or session token reuse from new IP addresses.
Monitor phishing telemetry for URLs referencing the reservation system domain paired with encoded XSS payloads.

How to Mitigate CVE-2024-2518

Immediate Actions Required

Restrict public exposure of the Online-College-Event-Hall-Reservation-System until compensating controls are in place, preferably by placing it behind authenticated access or an internal network segment.
Deploy WAF signatures that block requests to book_history.php where the id parameter contains HTML or script metacharacters.
Educate users of the application to avoid clicking unsolicited links pointing to the reservation system.

Patch Information

No vendor patch is available. According to the disclosure, the vendor was contacted prior to publication but did not respond. Organizations running this software should apply source-level fixes: validate that id is a numeric identifier and apply htmlspecialchars($id, ENT_QUOTES, 'UTF-8') before writing the value into HTML output. Track updates through the VulDB entry #256955.

Workarounds

Modify book_history.php locally to cast the id parameter to an integer using (int)$_GET['id'] before any use in output or database queries.
Add a Content-Security-Policy HTTP response header that disallows inline scripts and restricts script sources to trusted origins.
Set the HttpOnly and Secure flags on session cookies to reduce the impact of successful script execution.

bash

# Example nginx snippet to add a restrictive CSP for the application
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'" always;
add_header X-XSS-Protection "1; mode=block" always;
add_header X-Content-Type-Options "nosniff" always;