CVE-2024-2717: Campcodes DJ Booking System XSS Vulnerability

CVE-2024-2717 Overview

CVE-2024-2717 is a reflected cross-site scripting (XSS) vulnerability [CWE-79] in Campcodes Complete Online DJ Booking System 1.0. The flaw resides in the /admin/booking-search.php endpoint, where the searchdata parameter is reflected into the response without proper sanitization. An unauthenticated remote attacker can craft a malicious URL that executes arbitrary JavaScript in the context of a victim's browser session when the link is opened. The exploit has been publicly disclosed under the identifier VDB-257470.

Critical Impact
Successful exploitation allows attackers to run arbitrary script in an administrator's browser, enabling session theft, administrative action hijacking, and defacement of the booking portal.

Affected Products

Campcodes Complete Online DJ Booking System 1.0
Affected file: /admin/booking-search.php
Affected parameter: searchdata

Discovery Timeline

2024-03-20 - CVE-2024-2717 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-2717

Vulnerability Analysis

The vulnerability is a reflected XSS flaw in the administrative booking search feature. The searchdata HTTP parameter submitted to /admin/booking-search.php is rendered back into the HTML response without encoding or filtering. Because the application does not neutralize script-related characters such as <, >, and quotes, an attacker can inject HTML and JavaScript directly into the page.

Exploitation requires user interaction, typically through a crafted link delivered via phishing or embedded in an attacker-controlled page. When an authenticated administrator follows the link, the injected payload executes inside the admin session context. The attack is scoped to change (S:C), meaning injected script can affect resources beyond the vulnerable component, including cookies and tokens issued to other application paths.

Root Cause

The root cause is missing output encoding on user-controlled input. The searchdata value is echoed into the rendered HTML response as part of the search results page without applying contextual escaping such as htmlspecialchars() with ENT_QUOTES. The application also lacks a Content Security Policy (CSP) that would otherwise mitigate inline script execution.

Attack Vector

Attackers construct a URL targeting the /admin/booking-search.php endpoint with a JavaScript payload supplied in the searchdata query parameter. The payload is delivered to a logged-in administrator through phishing, forum links, or malicious referrers. When the victim opens the link, the browser renders the attacker-supplied markup, executing script that can exfiltrate session cookies, perform cross-site actions against the admin panel, or stage further attacks against the backend.

See the GitHub Vulnerability Document and VulDB entry #257470 for the public proof-of-concept documentation.

Detection Methods for CVE-2024-2717

Indicators of Compromise

HTTP requests to /admin/booking-search.php containing script tags, event handlers (onerror=, onload=), or JavaScript URI schemes in the searchdata parameter.
Encoded payload variants in searchdata such as URL-encoded %3Cscript%3E or HTML-entity obfuscation.
Unexpected outbound requests from administrator browsers to attacker-controlled domains shortly after visiting the booking admin console.

Detection Strategies

Deploy web application firewall (WAF) rules that flag XSS signatures in query parameters for the /admin/booking-search.php path.
Inspect web server access logs for anomalous query strings containing angle brackets, javascript:, or Base64 payloads targeting the vulnerable parameter.
Correlate referrer headers on admin sessions to identify administrators arriving at the search endpoint from external or untrusted origins.

Monitoring Recommendations

Enable verbose logging on the booking system web server and forward logs to a centralized analytics platform for rule-based alerting on XSS patterns.
Monitor administrator session cookies for use from unexpected geographic locations or user agents following suspicious requests.
Alert on new or unusual DOM-based network calls originating from the admin interface during browser telemetry collection.

How to Mitigate CVE-2024-2717

Immediate Actions Required

Restrict access to /admin/booking-search.php to trusted administrator IP ranges using web server access controls until a patch is deployed.
Instruct administrators to avoid clicking external links that reference the booking admin interface and to log out when not actively using the portal.
Enforce short session lifetimes and require re-authentication for sensitive administrative operations.

Patch Information

As of the last NVD update on 2026-06-17, Campcodes has not published a vendor security advisory addressing CVE-2024-2717. Operators should track the VulDB CTI entry #257470 for upstream fixes and apply any released update as soon as it is available.

Workarounds

Apply server-side output encoding to the searchdata parameter using htmlspecialchars($searchdata, ENT_QUOTES, 'UTF-8') before rendering it in the response.
Deploy a strict Content Security Policy that disallows inline scripts and restricts script sources to trusted origins to blunt payload execution.
Set the HttpOnly and Secure flags on administrator session cookies to limit the impact of script-based cookie theft.
Place the booking system behind a WAF with XSS filtering rules targeting administrative endpoints.

bash

# Example WAF rule (ModSecurity) blocking XSS payloads in searchdata
SecRule ARGS:searchdata "@rx (?i)(<script|javascript:|onerror=|onload=)" \
    "id:1002717,phase:2,deny,status:403,log,\
     msg:'CVE-2024-2717 XSS attempt in booking-search.php'"