CVE-2024-2720: Campcodes DJ Booking System XSS Vulnerability

CVE-2024-2720 Overview

CVE-2024-2720 is a reflected cross-site scripting (XSS) vulnerability in Campcodes Complete Online DJ Booking System 1.0. The flaw resides in the /admin/aboutus.php script, where the pagetitle parameter is rendered without proper output encoding. An attacker can inject arbitrary JavaScript that executes in the browser context of a victim administrator. The exploit has been publicly disclosed under identifier VDB-257473, increasing the likelihood of opportunistic abuse against exposed installations.

Critical Impact
Successful exploitation allows attackers to hijack administrator sessions, perform actions on behalf of authenticated users, and pivot deeper into the booking application.

Affected Products

Campcodes Complete Online DJ Booking System 1.0
Vulnerable component: /admin/aboutus.php
Vulnerable parameter: pagetitle

Discovery Timeline

2024-03-20 - CVE-2024-2720 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-2720

Vulnerability Analysis

The vulnerability is a reflected cross-site scripting issue [CWE-79] in the administrative About Us page of the DJ booking application. The pagetitle request parameter is echoed back into the HTML response without sanitization or contextual output encoding. An attacker who convinces an authenticated administrator to load a crafted URL can execute arbitrary JavaScript in that administrator's browser session. Because the payload runs in the admin context, it can read session cookies, submit form actions, and manipulate the DOM.

The attack requires user interaction, and the impact is limited to confidentiality and integrity of data accessible through the browser session. Chained with social engineering or admin-targeted phishing, the flaw is a practical foothold in unmaintained deployments.

Root Cause

The root cause is missing input validation and output encoding on the pagetitle parameter processed by /admin/aboutus.php. Untrusted input flows directly into an HTML sink, allowing script tags and event handlers to break out of the intended text context and execute as code.

Attack Vector

Exploitation is remote and delivered through a crafted URL or web request. The attacker sends a link containing a malicious pagetitle value to an authenticated administrator. When the target renders the response, injected JavaScript executes in the administrator's browser and can be used to exfiltrate cookies, perform CSRF-style actions, or deface administrative pages. See the GitHub Vulnerability Report and VulDB entry #257473 for the disclosed proof-of-concept details.

Detection Methods for CVE-2024-2720

Indicators of Compromise

Web server access logs containing requests to /admin/aboutus.php with pagetitle values that include HTML tags, <script>, onerror=, onload=, or URL-encoded equivalents such as %3Cscript%3E.
Referer headers on administrative pages originating from untrusted external domains.
Unexpected outbound requests from administrator browsers to attacker-controlled hosts shortly after loading the About Us page.

Detection Strategies

Deploy web application firewall (WAF) signatures that flag reflected script payloads targeting pagetitle and similar administrative parameters.
Enable and review PHP application-level logging for requests to /admin/aboutus.php with anomalous query string lengths or non-alphanumeric characters.
Correlate administrator authentication events with suspicious outbound traffic from admin workstations to identify session-token exfiltration.

Monitoring Recommendations

Alert on any HTTP request to /admin/* containing angle brackets or JavaScript event handlers in query parameters.
Monitor for anomalous administrator session activity such as unexpected content changes to About Us pages or new administrator accounts.
Track browser telemetry from privileged users for script errors and Content Security Policy violations tied to the application origin.

How to Mitigate CVE-2024-2720

Immediate Actions Required

Restrict access to /admin/ paths using network-level allowlists or VPN-only access until a fix is available.
Instruct administrators to avoid clicking untrusted links while authenticated to the booking system.
Deploy WAF rules that block script tags and JavaScript event handlers in the pagetitle parameter.

Patch Information

No vendor patch has been referenced in the NVD entry for CVE-2024-2720. Operators should monitor the Campcodes product page for updates and consider replacing the application if the vendor does not issue a fix. Consult VulDB #257473 for tracking status.

Workarounds

Add server-side input validation on the pagetitle parameter to reject any input containing <, >, or quote characters.
Apply context-aware output encoding in /admin/aboutus.php before rendering pagetitle in HTML.
Enforce a strict Content Security Policy (CSP) that disallows inline scripts and restricts script sources to the application origin.
Require re-authentication and enable short session timeouts for administrative users.

bash

# Example WAF rule (ModSecurity) to block reflected XSS on pagetitle
SecRule ARGS:pagetitle "@rx (?i)(<script|onerror=|onload=|javascript:)" \
    "id:1002720,phase:2,deny,status:403,\
    msg:'CVE-2024-2720 XSS attempt on pagetitle',\
    tag:'CWE-79'"