CVE-2024-3377: Computer Laboratory Management System XSS

CVE-2024-3377 Overview

CVE-2024-3377 is a cross-site scripting (XSS) vulnerability [CWE-79] in SourceCodester Computer Laboratory Management System 1.0. The flaw resides in /classes/SystemSettings.php?f=update_settings, where the name parameter is not properly sanitized before being reflected back to users. Attackers can inject arbitrary JavaScript into the application, which executes in the browser context of any user viewing the affected page. The exploit has been publicly disclosed, increasing the likelihood of opportunistic attacks against unpatched deployments.

Critical Impact
Remote attackers can inject persistent JavaScript through the system settings update endpoint, enabling session theft, credential harvesting, and administrative account takeover.

Affected Products

Oretnom23 (SourceCodester) Computer Laboratory Management System 1.0
CPE: cpe:2.3:a:oretnom23:computer_laboratory_management_system:1.0
Deployments exposing /classes/SystemSettings.php to untrusted users

Discovery Timeline

2024-04-06 - CVE-2024-3377 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-3377

Vulnerability Analysis

The vulnerability exists in the settings update handler of the Computer Laboratory Management System. When an authenticated user submits data to /classes/SystemSettings.php?f=update_settings, the application accepts the name parameter without applying output encoding or input sanitization. The unsanitized value is then rendered back into HTML output, allowing script payloads to execute in the victim's browser.

Because the payload is stored server-side in the application's configuration, subsequent visitors trigger the injected script automatically. This produces a stored XSS condition rather than a purely reflected one, expanding the attack surface to any user who loads pages that render the tainted setting.

A public write-up documenting the vulnerability was released on GitHub, and it is tracked as VulDB entry 259498. The current EPSS probability is 0.629%.

Root Cause

The root cause is missing input validation and output encoding on the name field processed by SystemSettings.php. The application concatenates user-supplied data directly into HTML responses without invoking a context-aware escaping routine such as htmlspecialchars().

Attack Vector

Exploitation requires network access to the application and user interaction to trigger the payload. An attacker submits a crafted name value containing HTML or JavaScript tags to the update_settings action. When an administrator or other user later views the settings page, the browser parses and executes the injected script under the application's origin.

Refer to the public proof-of-concept write-up for the specific payload structure used to demonstrate script execution against the name parameter.

Detection Methods for CVE-2024-3377

Indicators of Compromise

HTTP POST requests to /classes/SystemSettings.php?f=update_settings containing <script>, onerror=, onload=, or javascript: substrings in the name field
Unexpected modifications to the system settings record, particularly in the site name or branding fields
Outbound browser requests from administrative sessions to attacker-controlled domains shortly after visiting settings pages

Detection Strategies

Deploy web application firewall (WAF) rules that inspect request bodies to SystemSettings.php for HTML tag patterns and event handler attributes
Review web server access logs for POST requests to update_settings originating from unauthenticated or unexpected source addresses
Correlate settings-modification events with subsequent anomalous administrator session activity

Monitoring Recommendations

Enable Content Security Policy (CSP) violation reporting to capture inline script executions attempted from the settings context
Alert on any changes to system configuration tables outside of scheduled maintenance windows
Monitor administrator browsers for cookie theft indicators, including sudden session invalidations and logins from new geographies

How to Mitigate CVE-2024-3377

Immediate Actions Required

Restrict network access to the Computer Laboratory Management System to trusted internal ranges until a fix is applied
Require reauthentication for administrative accounts and rotate any session tokens issued while the application was exposed
Audit the system_settings table for previously injected payloads and remove malicious entries

Patch Information

No vendor advisory or official patch is listed in the NVD references for CVE-2024-3377. Organizations running SourceCodester Computer Laboratory Management System 1.0 should treat the software as unpatched and apply source-level fixes: sanitize the name parameter server-side with input validation and encode all reflected values using htmlspecialchars($value, ENT_QUOTES, 'UTF-8') before rendering.

Workarounds

Place the application behind a WAF with signatures blocking HTML and JavaScript metacharacters in the name parameter
Implement a strict Content Security Policy that disallows inline scripts and unsafe evaluation
Limit access to /classes/SystemSettings.php to specific administrative IP addresses via web server ACLs
Consider migrating to a maintained laboratory management platform if source code modifications are not feasible

bash

# Example nginx configuration to restrict access and add CSP
location /classes/SystemSettings.php {
    allow 10.0.0.0/8;
    deny all;
    add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'";
    add_header X-XSS-Protection "1; mode=block";
}