CVE-2024-2719: Campcodes DJ Booking System XSS Vulnerability

CVE-2024-2719 Overview

CVE-2024-2719 is a cross-site scripting (XSS) vulnerability [CWE-79] in Campcodes Complete Online DJ Booking System 1.0. The flaw resides in the /admin/admin-profile.php endpoint, where the adminname parameter is reflected to users without proper output encoding. An unauthenticated remote attacker can craft a malicious link that executes arbitrary JavaScript in the victim's browser session. The exploit has been publicly disclosed under VulDB identifier VDB-257472, increasing the likelihood of opportunistic use against exposed installations.

Critical Impact

Successful exploitation allows attackers to execute arbitrary script in an administrator's browser, enabling session theft, administrative action hijacking, and defacement of the booking portal.

Affected Products

• Campcodes Complete Online DJ Booking System 1.0
• Component: /admin/admin-profile.php
• Vulnerable parameter: adminname

Discovery Timeline

• 2024-03-20 - CVE-2024-2719 published to NVD
• 2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-2719

Vulnerability Analysis

The vulnerability is a reflected cross-site scripting flaw in the administrative profile page of the DJ booking application. The adminname request parameter is written back into the HTML response without contextual output encoding or input sanitization. An attacker who convinces an authenticated administrator to click a crafted URL can execute JavaScript inside the admin's authenticated session context. Because the attack targets administrative functionality, successful execution grants the attacker leverage over the application's management surface.

User interaction is required to trigger the payload, which is consistent with reflected XSS patterns. The attack can be delivered through phishing emails, chat links, or malicious third-party sites that redirect to the vulnerable endpoint.

Root Cause

The root cause is improper neutralization of input during web page generation in /admin/admin-profile.php. The application fails to apply HTML entity encoding or allow-list validation on the adminname argument before echoing it into the response body. This maps directly to CWE-79, Improper Neutralization of Input During Web Page Generation.

Attack Vector

The attack is network-reachable and requires no authentication from the attacker, but does require a targeted administrator to load the crafted URL. A typical exploitation flow involves appending a JavaScript payload to the adminname query parameter and distributing the link through phishing. When rendered, the payload executes in the browser under the application's origin, enabling cookie theft, forced requests to administrative actions, or injection of a client-side keylogger. See the GitHub Vulnerability Report and VulDB entry #257472 for further technical context.

Detection Methods for CVE-2024-2719

Indicators of Compromise

• HTTP requests to /admin/admin-profile.php containing <script>, onerror=, onload=, or URL-encoded equivalents in the adminname parameter.
• Referrer headers pointing to external domains preceding administrator sessions on the booking portal.
• Unexpected outbound requests from administrator browsers to attacker-controlled hosts shortly after visiting the profile page.

Detection Strategies

• Deploy a web application firewall (WAF) rule that inspects the adminname parameter for HTML and JavaScript metacharacters.
• Enable application-level logging of all query strings submitted to /admin/* endpoints and alert on payloads containing script tags or event handlers.
• Review server access logs for anomalous Base64 or percent-encoded payloads targeting the admin profile page.

Monitoring Recommendations

• Monitor administrator account activity for session cookie reuse from unfamiliar IP addresses or user agents.
• Alert on sudden configuration changes, new administrator accounts, or password resets originating from admin sessions.
• Track referrer anomalies and off-domain redirects preceding admin login activity.

How to Mitigate CVE-2024-2719

Immediate Actions Required

• Restrict access to /admin/ paths to trusted source IP ranges or a VPN until a fix is deployed.
• Instruct administrators to avoid clicking external links that reference the booking portal and to log out when not actively managing the application.
• Deploy a WAF signature that blocks HTML and JavaScript characters in the adminname parameter.

Patch Information

No vendor advisory or official patch has been published for Campcodes Complete Online DJ Booking System 1.0 at the time of this writing. Operators should contact the vendor for remediation status and consider migrating to an actively maintained booking platform if a fix is not forthcoming.

Workarounds

• Apply a reverse-proxy filter that HTML-encodes or rejects requests containing <, >, ", ', or & in the adminname parameter.
• Set a strict Content-Security-Policy header on administrative pages to disallow inline scripts and limit script sources to the application origin.
• Set the HttpOnly and SameSite=Strict flags on administrative session cookies to reduce the impact of script execution.

# Example NGINX reverse-proxy rule to block script payloads in the adminname parameter
location /admin/admin-profile.php {
    if ($arg_adminname ~* "(<|%3C)[^>]*script") {
        return 403;
    }
    add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'" always;
    add_header X-XSS-Protection "1; mode=block" always;
    proxy_pass http://backend;
}