CVE-2024-33989: Janobe School Event Management System XSS

CVE-2024-33989 Overview

CVE-2024-33989 is a reflected Cross-Site Scripting (XSS) vulnerability [CWE-79] in Janobe School Event Management System version 1.0. The flaw resides in the event_print.php script located under the port/ directory. Attackers can inject malicious JavaScript through the eventdate and events request parameters. When an authenticated user loads a crafted URL, the payload executes in the victim's browser context. Successful exploitation enables partial session takeover, credential theft, and unauthorized actions performed on behalf of the user.

Critical Impact
Attackers can hijack authenticated browser sessions and execute arbitrary JavaScript in the context of the School Event Management System web application.

Affected Products

Janobe School Event Management System 1.0
Vulnerable script: port/event_print.php
Vulnerable parameters: eventdate and events

Discovery Timeline

2024-08-06 - CVE-2024-33989 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-33989

Vulnerability Analysis

The vulnerability is a reflected XSS flaw in the Janobe School Event Management System 1.0. The port/event_print.php endpoint accepts user-controlled values via the eventdate and events query parameters. These values are rendered back into the HTML response without proper output encoding or input sanitization.

An attacker crafts a URL containing JavaScript inside either parameter and delivers it to an authenticated user through phishing or a malicious link. When the victim follows the link, the browser renders the attacker's script within the application's origin. The script executes with the privileges of the authenticated session.

The attack requires user interaction and a changed scope, meaning the injected script can affect resources outside the vulnerable component. Confidentiality and integrity are both impacted at a limited level, consistent with session-related data exposure and manipulation.

Root Cause

The root cause is improper neutralization of input during web page generation [CWE-79]. The event_print.php script fails to encode HTML metacharacters contained in the eventdate and events parameters before echoing them into the response body. This allows raw <script> elements and event-handler attributes to render as executable markup.

Attack Vector

Exploitation occurs over the network and requires user interaction. An attacker crafts a URL targeting port/event_print.php with a JavaScript payload in eventdate or events. The attacker delivers the link to an authenticated user through social engineering. Upon click, the payload runs in the victim's browser and can read session cookies, perform actions, or redirect the user to attacker-controlled infrastructure. See the INCIBE Security Notice on Vulnerabilities for additional technical context.

Detection Methods for CVE-2024-33989

Indicators of Compromise

HTTP requests to port/event_print.php containing <script>, javascript:, or encoded variants in the eventdate or events parameters.
Outbound browser connections to unexpected domains originating immediately after a user visits a School Event Management System URL.
Session cookies appearing in referrer headers or external request logs tied to the application.

Detection Strategies

Inspect web server access logs for query strings targeting event_print.php with suspicious characters such as <, >, %3C, onerror=, or document.cookie.
Deploy a Web Application Firewall (WAF) rule to flag XSS signatures in requests to the vulnerable endpoint.
Correlate authenticated user sessions with anomalous DOM activity or unexpected redirects on client-side telemetry.

Monitoring Recommendations

Enable verbose HTTP request logging on the web server hosting the School Event Management System.
Forward web, proxy, and endpoint telemetry into a centralized analytics platform for correlation of XSS delivery and session abuse.
Alert on repeated requests to port/event_print.php from the same source containing script-like payloads.

How to Mitigate CVE-2024-33989

Immediate Actions Required

Restrict access to the port/event_print.php endpoint to trusted internal networks until a fix is deployed.
Enforce a strict Content Security Policy (CSP) that disallows inline scripts to limit payload execution.
Educate authenticated users to avoid clicking unsolicited links referencing the application.

Patch Information

No vendor patch is listed in the NVD or in the INCIBE Security Notice on Vulnerabilities for Janobe School Event Management System 1.0 at the time of writing. Organizations should contact the vendor for remediation guidance or discontinue use of the affected version.

Workarounds

Deploy a WAF rule to block or sanitize requests to port/event_print.php containing HTML or JavaScript metacharacters in eventdate and events.
Apply server-side input validation and output encoding on both parameters using context-appropriate HTML entity encoding.
Set the HttpOnly and Secure flags on session cookies to reduce the impact of script-based session theft.

bash

# Example ModSecurity rule to block XSS attempts on the vulnerable endpoint
SecRule REQUEST_URI "@contains /port/event_print.php" \
  "chain,id:1003389,phase:2,deny,status:403,msg:'CVE-2024-33989 XSS attempt blocked'"
  SecRule ARGS:eventdate|ARGS:events "@rx (?i)(<script|javascript:|onerror=|onload=)" "t:none,t:urlDecodeUni"