CVE-2024-2716: DJ Booking System XSS Vulnerability

CVE-2024-2716 Overview

CVE-2024-2716 is a reflected cross-site scripting (XSS) vulnerability in Campcodes Complete Online DJ Booking System 1.0. The flaw resides in the /admin/contactus.php script, where the email parameter is rendered without proper output encoding. A remote attacker can craft a malicious link that injects arbitrary JavaScript into the administrator's browser session. The issue is tracked as VulDB entry VDB-257469 and maps to [CWE-79]. Exploit details have been publicly disclosed, though no automated exploit tooling is currently indexed in public exploit databases.

Critical Impact
Successful exploitation executes attacker-controlled JavaScript in the context of an authenticated administrator, enabling session theft, credential harvesting, and administrative action forgery.

Affected Products

Campcodes Complete Online DJ Booking System 1.0
Vulnerable component: /admin/contactus.php
Vulnerable parameter: email

Discovery Timeline

2024-03-20 - CVE-2024-2716 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-2716

Vulnerability Analysis

The vulnerability is a reflected cross-site scripting flaw in the administrative contact management script /admin/contactus.php. User-supplied input to the email argument is echoed back into the HTTP response without HTML entity encoding or contextual output escaping. An attacker can therefore embed script tags or event handlers within the parameter value. When an administrator clicks a crafted link, the payload executes inside the trusted origin of the DJ Booking System's admin console. Because the classification is CWE-79 with a scope change, the injected script runs with the same privileges as the targeted administrator session.

Root Cause

The application concatenates the email request parameter into rendered HTML without sanitization or output encoding. PHP applications that emit request data through echo or interpolation without functions such as htmlspecialchars() are susceptible to this class of defect. The trust boundary between untrusted HTTP input and the admin page's HTML context is not enforced.

Attack Vector

Exploitation requires user interaction. An attacker delivers a crafted URL targeting /admin/contactus.php with a script payload placed in the email parameter. When an authenticated administrator visits the link, the browser parses and executes the injected JavaScript in the application's origin. Consequences include stolen session cookies, forced state-changing requests against the admin panel, keystroke capture on the admin console, and defacement of admin views. No authentication is required from the attacker to craft the payload; only the victim must be authenticated for high-impact abuse.

Full technical details are documented in the GitHub Vulnerability Report and the VulDB entry #257469.

Detection Methods for CVE-2024-2716

Indicators of Compromise

HTTP requests to /admin/contactus.php where the email parameter contains HTML tags, <script>, javascript:, or event handler substrings such as onerror= and onload=.
URL-encoded XSS payloads targeting the email argument, including %3Cscript%3E and %22%3E%3Csvg.
Referrer headers pointing to external sites immediately preceding administrator visits to /admin/contactus.php.

Detection Strategies

Deploy web application firewall signatures that inspect query strings and POST bodies to /admin/* for reflected XSS patterns.
Correlate administrator authentication events with anomalous outbound HTTP requests from the admin browser to unknown domains, indicating potential cookie exfiltration.
Enable Content Security Policy (CSP) violation reporting to surface inline-script execution attempts in the admin interface.

Monitoring Recommendations

Log and retain full request URIs and parameters for all /admin endpoints, and alert on payloads containing script markup.
Monitor administrator sessions for unexpected privilege actions initiated within seconds of clicking external links.
Track baseline behavior of the admin console and flag deviations such as new user creation or configuration changes originating from unusual referers.

How to Mitigate CVE-2024-2716

Immediate Actions Required

Restrict access to /admin/contactus.php to trusted management IP ranges using web server or firewall rules until a patched build is deployed.
Instruct administrators not to follow untrusted links to the booking system and to use dedicated, hardened browsers for admin work.
Enforce a strict Content Security Policy that disallows inline scripts on the admin interface to blunt payload execution.

Patch Information

No vendor advisory or official patch has been published by Campcodes for CVE-2024-2716 at the time of the NVD entry's last modification on 2026-06-17. Operators should apply source-level fixes by wrapping all reflected request values in htmlspecialchars($value, ENT_QUOTES, 'UTF-8') before output, and by validating the email parameter against a strict RFC 5322 pattern.

Workarounds

Place the application behind a web application firewall configured to block reflected XSS payloads targeting the email parameter.
Set the HttpOnly and Secure flags on session cookies to reduce the impact of stolen session tokens.
Add the SameSite=Strict cookie attribute to limit cross-origin CSRF chains that pair with the XSS payload.
If the contact management feature is not required, disable or remove /admin/contactus.php from the deployment.

bash

# Example Apache configuration to restrict admin access and enforce CSP
<Location "/admin/">
    Require ip 10.0.0.0/8
    Header always set Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; frame-ancestors 'none'"
    Header always set X-XSS-Protection "1; mode=block"
    Header always set X-Content-Type-Options "nosniff"
</Location>