CVE-2024-2718: Campcodes DJ Booking System XSS Vulnerability

CVE-2024-2718 Overview

CVE-2024-2718 is a reflected cross-site scripting (XSS) vulnerability [CWE-79] in Campcodes Complete Online DJ Booking System 1.0. The flaw resides in /admin/booking-bwdates-reports-details.php, where the fromdate parameter is reflected without proper sanitization. Attackers can craft a malicious URL that executes arbitrary JavaScript in the context of an authenticated administrator's browser session. The vulnerability is exploitable remotely and requires user interaction, typically through a crafted link. The exploit has been publicly disclosed, increasing the risk of opportunistic abuse against exposed deployments.

Critical Impact
Successful exploitation allows session hijacking, administrative action forgery, and credential theft against users of the booking system's admin panel.

Affected Products

Campcodes Complete Online DJ Booking System 1.0
Component: /admin/booking-bwdates-reports-details.php
Vulnerable parameter: fromdate

Discovery Timeline

2024-03-20 - CVE-2024-2718 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-2718

Vulnerability Analysis

The vulnerability is a reflected XSS flaw in the booking reports administrative component. The booking-bwdates-reports-details.php script accepts user-supplied input through the fromdate HTTP parameter. The application echoes this value back into the HTML response without encoding or validation. An attacker who can convince an authenticated administrator to click a crafted link can execute arbitrary JavaScript in that administrator's browser. Because the vulnerable endpoint resides in the admin interface, successful exploitation operates with the privileges of the targeted user. Attackers commonly use this type of flaw to steal session cookies, perform forced administrative actions, or pivot to additional server-side attacks.

Root Cause

The root cause is missing input validation and output encoding on the fromdate request parameter. The application fails to apply contextual output escaping (such as htmlspecialchars() in PHP) before rendering the parameter inside the HTML response. This failure to neutralize user-controlled input before reflection is the canonical pattern described by CWE-79.

Attack Vector

Exploitation requires a network-reachable instance of the application and user interaction. The attacker crafts a URL targeting /admin/booking-bwdates-reports-details.php with a malicious payload in the fromdate parameter. The attacker then delivers this URL through phishing, social engineering, or an open redirect. When an authenticated administrator loads the URL, the injected script runs in the origin of the booking application. The scope change in the CVSS vector reflects that the impact can cross security boundaries, such as exfiltrating data to a third-party domain. Refer to the public vulnerability document on GitHub for additional technical context.

Detection Methods for CVE-2024-2718

Indicators of Compromise

Web server access logs containing requests to /admin/booking-bwdates-reports-details.php with HTML tags, script references, or URL-encoded <, >, and javascript: sequences in the fromdate parameter.
Referrer headers pointing to untrusted external domains preceding admin page requests.
Unexpected outbound requests from administrator browsers to attacker-controlled hosts shortly after visiting the booking admin interface.

Detection Strategies

Deploy a web application firewall (WAF) rule set that inspects query parameters for XSS payload signatures, including angle brackets, event handlers (onerror, onload), and javascript: schemes.
Perform static analysis of PHP source to identify request parameters rendered without htmlspecialchars() or equivalent encoding.
Monitor endpoint telemetry on administrator workstations for anomalous script execution originating from the booking application domain.

Monitoring Recommendations

Alert on HTTP 200 responses to admin endpoints where the request contained reflected special characters in parameters.
Track administrator session cookie usage from unexpected IP addresses or geolocations.
Correlate authentication events with outbound HTTP traffic from administrator endpoints to identify potential cookie exfiltration.

How to Mitigate CVE-2024-2718

Immediate Actions Required

Restrict access to the /admin/ directory to trusted IP ranges or require VPN access until a fix is validated.
Deploy WAF rules that block requests containing XSS indicators in the fromdate parameter and similar date fields.
Instruct administrators to avoid clicking links to the application from untrusted sources and to log out when the admin interface is not in use.

Patch Information

No official vendor patch is referenced in the public advisory data for Campcodes Complete Online DJ Booking System 1.0. Organizations should monitor the vendor site and the VulDB entry for ID 257471 for updates. In the absence of a vendor fix, apply source-level remediation by escaping all reflected parameters with htmlspecialchars($input, ENT_QUOTES, 'UTF-8') before output.

Workarounds

Apply a Content Security Policy (CSP) header that disallows inline scripts and restricts script sources to the application origin.
Set the HttpOnly and Secure flags on administrator session cookies to limit cookie theft via injected JavaScript.
Enforce the SameSite=Strict attribute on authentication cookies to reduce the impact of cross-site navigation attacks.

bash

# Example Apache configuration to add defensive headers
Header always set Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'"
Header always set X-XSS-Protection "1; mode=block"
Header always edit Set-Cookie ^(.*)$ "$1; HttpOnly; Secure; SameSite=Strict"