CVE-2024-2597: AMSS++ Cross-Site Scripting Vulnerability

CVE-2024-2597 Overview

CVE-2024-2597 is a reflected Cross-Site Scripting (XSS) vulnerability in AMSS++ version 4.31. The flaw resides in the /amssplus/modules/book/main/bookdetail_school_person.php endpoint, where the b_id parameter is not sufficiently encoded before being reflected back in the HTTP response. A remote attacker can craft a malicious URL and deliver it to an authenticated user. If the victim clicks the link, arbitrary JavaScript executes in their browser session. The attacker can then steal session cookies and hijack the authenticated session. The vulnerability is classified under [CWE-79] (Improper Neutralization of Input During Web Page Generation).

Critical Impact
Successful exploitation lets an attacker execute arbitrary script in the context of an authenticated AMSS++ session and steal cookie credentials.

Affected Products

AMSS++ 4.31
/amssplus/modules/book/main/bookdetail_school_person.php endpoint
Deployments exposing the b_id GET parameter without input encoding

Discovery Timeline

2024-03-18 - CVE-2024-2597 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-2597

Vulnerability Analysis

The vulnerability is a reflected XSS flaw affecting the AMSS++ book module. The application accepts the b_id query parameter at /amssplus/modules/book/main/bookdetail_school_person.php and renders its value in the HTTP response without output encoding. An attacker who places JavaScript payloads in b_id triggers execution in the victim's browser when the URL is visited.

Exploitation requires user interaction. The victim must be authenticated and click a specially crafted link. Because the payload runs within the AMSS++ origin, it can read document.cookie and exfiltrate session identifiers to attacker-controlled infrastructure. The scope-changed CVSS metric reflects that the injected script affects resources beyond the vulnerable component itself.

Root Cause

The root cause is missing output encoding of user-controlled input [CWE-79]. The bookdetail_school_person.php script reflects the b_id value into HTML markup without applying contextual encoding such as HTML entity escaping. Any string containing <script> tags, event handlers, or JavaScript URIs is parsed and executed by the browser as part of the page.

Attack Vector

The attack vector is network-based and requires user interaction. An attacker constructs a URL of the form https://<target>/amssplus/modules/book/main/bookdetail_school_person.php?b_id=<payload>, where <payload> is a URL-encoded JavaScript snippet. The attacker delivers the URL to an authenticated AMSS++ user through phishing, chat, or embedded content. Upon load, the injected script executes with the privileges of the victim's active session and can transmit cookies to an external endpoint. See the INCIBE Security Notice for coordinated disclosure details.

Detection Methods for CVE-2024-2597

Indicators of Compromise

Web server access logs containing requests to bookdetail_school_person.php with b_id values holding HTML tags, javascript: URIs, or encoded <script> sequences
Outbound HTTP requests from user browsers to unfamiliar domains immediately following access to the AMSS++ book module
Unexpected session reuse from distinct IP addresses or user-agents within short time windows

Detection Strategies

Deploy web application firewall (WAF) signatures that inspect the b_id parameter for script tags, event handlers, and encoded JavaScript payloads
Enable verbose HTTP request logging on the AMSS++ host and alert on query strings containing <, >, onerror=, or onload=
Correlate authentication events with sudden geographic or device changes indicative of stolen session cookies

Monitoring Recommendations

Forward web server and WAF telemetry to a centralized SIEM for query parameter inspection and anomaly correlation
Monitor browser Content Security Policy (CSP) violation reports if CSP is deployed in report-only mode
Track failure patterns across the AMSS++ URL namespace to identify active probing of injection points

How to Mitigate CVE-2024-2597

Immediate Actions Required

Restrict external access to /amssplus/modules/book/main/bookdetail_school_person.php while a patch is evaluated
Deploy a WAF rule to reject requests where b_id contains HTML metacharacters or JavaScript keywords
Instruct AMSS++ users to avoid clicking AMSS++ links received outside authorized channels

Patch Information

No vendor patch URL is listed in the enriched CVE data. Administrators should contact the AMSS++ project maintainers for an updated release and consult the INCIBE Security Notice for current remediation status.

Workarounds

Apply server-side input validation that rejects non-numeric values for the b_id parameter if it is intended to carry an identifier
Enforce contextual output encoding, such as htmlspecialchars($b_id, ENT_QUOTES, 'UTF-8'), before rendering the value in HTML
Deploy a strict Content Security Policy that disallows inline scripts and restricts script sources to trusted origins
Set the HttpOnly and Secure attributes on session cookies to limit the impact of successful XSS

bash

# Example Apache mod_security rule to block script payloads in b_id
SecRule ARGS:b_id "@rx (?i)(<script|javascript:|onerror=|onload=)" \
    "id:1002597,phase:2,deny,status:403,msg:'CVE-2024-2597 AMSS++ XSS attempt blocked'"