CVE-2024-3004: Online Book System XSS Vulnerability

CVE-2024-3004 Overview

CVE-2024-3004 is a reflected cross-site scripting (XSS) vulnerability in code-projects Online Book System 1.0. The flaw resides in the /Product.php file, where the value argument is rendered without proper output encoding. Remote attackers can craft a malicious URL that injects arbitrary JavaScript into a victim's browser session. The vulnerability requires user interaction, such as clicking a crafted link, and executes in the context of the affected web application. The exploit details have been publicly disclosed under identifier VDB-258206.

Critical Impact
Successful exploitation allows attackers to execute arbitrary script in the victim's browser, enabling session hijacking, credential theft, and phishing against users of the Online Book System.

Affected Products

code-projects Online Book System 1.0
Anisha Online Book System (anisha:online_book_system:1.0)
Deployments exposing /Product.php to untrusted input

Discovery Timeline

2024-03-27 - CVE-2024-3004 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-3004

Vulnerability Analysis

The vulnerability is a reflected cross-site scripting issue classified under [CWE-79]. The /Product.php script accepts the value parameter from HTTP requests and echoes it back into the HTML response without sanitization or contextual output encoding. When a victim visits a specially crafted URL, the injected payload executes in their browser under the origin of the vulnerable application.

Because the attack changes the security scope, an attacker can leverage the flaw to interact with content beyond the vulnerable component's original scope. This includes reading cookies, session tokens, or DOM data belonging to the affected origin. The vulnerability has been publicly disclosed, which increases the likelihood of opportunistic exploitation against exposed instances.

Root Cause

The root cause is missing input validation and output encoding on the value GET parameter processed by /Product.php. User-controlled data is concatenated directly into the HTML response. No allowlist filtering, HTML entity encoding, or Content Security Policy mitigates the injection point.

Attack Vector

Exploitation occurs over the network and requires user interaction. An attacker delivers a crafted link, typically through phishing, chat, or a malicious referrer, that carries a JavaScript payload in the value parameter. When the victim opens the link on a vulnerable instance, the browser renders and executes the attacker-supplied script within the application's origin.

See the GitHub Cross-Site Scripting Analysis for the disclosed proof-of-concept request format and additional technical detail.

Detection Methods for CVE-2024-3004

Indicators of Compromise

HTTP GET requests to /Product.php containing <script>, onerror=, onload=, or javascript: tokens in the value parameter.
URL-encoded XSS payloads such as %3Cscript%3E or %3Cimg targeting the value query string.
Unusual outbound requests from user browsers to attacker-controlled domains shortly after visiting /Product.php links.

Detection Strategies

Deploy web application firewall (WAF) rules that flag known XSS payload signatures on requests to /Product.php.
Enable request logging on the web server and parse access logs for suspicious characters in the value parameter.
Correlate email gateway telemetry with web proxy logs to identify inbound phishing URLs referencing the vulnerable endpoint.

Monitoring Recommendations

Monitor for unexpected client-side script execution and Content Security Policy (CSP) violation reports from application users.
Alert on anomalous session activity such as concurrent logins, token reuse, or account changes following visits to /Product.php.
Baseline normal parameter values submitted to /Product.php and generate alerts on deviations containing HTML or script syntax.

How to Mitigate CVE-2024-3004

Immediate Actions Required

Restrict access to /Product.php at the reverse proxy or WAF until a fix is applied.
Apply server-side input validation and HTML entity encoding to the value parameter and any other user-controlled inputs reflected in responses.
Deploy a strict Content Security Policy that disallows inline scripts and untrusted script sources.
Notify users of the potential phishing risk and remind them not to click untrusted links referencing the application.

Patch Information

No official vendor patch is listed in the NVD advisory for CVE-2024-3004. Administrators should track the VulDB entry #258206 for updates and consult the GitHub Cross-Site Scripting Analysis for remediation guidance. In the absence of an upstream fix, apply source-level patches that sanitize the value parameter using functions such as htmlspecialchars($value, ENT_QUOTES, 'UTF-8') before rendering.

Workarounds

Configure a WAF rule to block requests to /Product.php containing HTML tags, script syntax, or event-handler attributes in query parameters.
Set the HttpOnly and Secure flags on session cookies to reduce impact if a payload executes.
Restrict access to the application to authenticated internal users via network segmentation or VPN until the code is patched.
Consider decommissioning or replacing Online Book System 1.0 if no maintained fork is available.

bash

# Example ModSecurity rule to block reflected XSS attempts on /Product.php
SecRule REQUEST_URI "@beginsWith /Product.php" \
    "phase:2,deny,status:403,id:1003004,\
    msg:'Blocked potential XSS on Product.php (CVE-2024-3004)',\
    chain"
    SecRule ARGS:value "@rx (?i)(<script|onerror=|onload=|javascript:)" \
        "t:none,t:urlDecodeUni,t:htmlEntityDecode"