CVE-2024-3528: Campcodes Student Management System XSS Flaw

CVE-2024-3528 Overview

CVE-2024-3528 is a reflected cross-site scripting (XSS) vulnerability in Campcodes Complete Online Student Management System 1.0. The flaw resides in units_view.php, where the FirstRecord parameter is reflected into the response without proper output encoding. An unauthenticated remote attacker can craft a URL that injects arbitrary JavaScript into the browser of a victim who follows the link. The issue is tracked as VulDB entry VDB-259898 and mapped to CWE-79. The exploit details have been publicly disclosed.

Critical Impact
Attackers can execute arbitrary script in a victim's browser session, enabling session hijacking, credential theft, and unauthorized actions within the student management application.

Affected Products

Campcodes Complete Online Student Management System 1.0
Component: units_view.php
Parameter: FirstRecord

Discovery Timeline

2024-04-10 - CVE-2024-3528 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-3528

Vulnerability Analysis

The vulnerability is a reflected cross-site scripting flaw classified under [CWE-79]. The units_view.php endpoint accepts the FirstRecord HTTP parameter and embeds its value into rendered HTML without contextual encoding. An attacker who tricks an authenticated administrator or user into visiting a crafted URL can execute JavaScript in the victim's browser under the origin of the vulnerable application.

Successful exploitation grants the attacker access to session cookies, allows form manipulation, and enables actions on behalf of the victim within the student management portal. Because the application handles student records and administrative functions, XSS can lead to unauthorized data disclosure and account takeover.

Root Cause

The root cause is missing input sanitization and output encoding on the FirstRecord query parameter in units_view.php. User-supplied data flows directly into the HTML response context without HTML entity encoding or filtering. The application does not enforce a Content Security Policy that would restrict inline script execution.

Attack Vector

Exploitation requires network access to the vulnerable application and user interaction, typically by clicking a crafted link. The attacker constructs a URL targeting units_view.php with a malicious payload in the FirstRecord parameter. When the victim's browser renders the response, the injected script executes in the security context of the vulnerable site.

No verified proof-of-concept code is available in the referenced sources. Technical details are documented in the GitHub Vulnerability Document and the VulDB CVE Reference.

Detection Methods for CVE-2024-3528

Indicators of Compromise

Web server access logs containing requests to units_view.php with suspicious characters in the FirstRecord parameter such as <script>, onerror=, javascript:, or URL-encoded equivalents (%3Cscript%3E).
Referrer headers pointing to external phishing or attacker-controlled domains that redirect to the vulnerable endpoint.
Unexpected outbound requests from user browsers to unknown domains shortly after visits to the application.

Detection Strategies

Deploy a web application firewall (WAF) rule that inspects query parameters on units_view.php for common XSS payloads and encoding tricks.
Enable server-side request logging with full query strings to enable retrospective hunting for injection attempts.
Correlate authentication events with anomalous session activity that may indicate stolen cookies from an XSS payload.

Monitoring Recommendations

Alert on repeated requests to units_view.php from single source IPs containing HTML or JavaScript metacharacters.
Monitor for administrator sessions being used from unusual geolocations or user agents following a suspicious click event.
Track browser Content Security Policy violation reports if CSP is deployed in report-only mode.

How to Mitigate CVE-2024-3528

Immediate Actions Required

Restrict access to the Campcodes Complete Online Student Management System 1.0 application to trusted networks until a fix is applied.
Deploy a WAF policy that blocks XSS patterns targeting the FirstRecord parameter on units_view.php.
Instruct administrators and users to avoid clicking untrusted links referencing the application.

Patch Information

No official vendor advisory or patch has been published in the referenced sources. Organizations running Campcodes Complete Online Student Management System 1.0 should contact the vendor for remediation guidance or apply source-level fixes by HTML-encoding the FirstRecord parameter before rendering it.

Workarounds

Modify units_view.php to apply htmlspecialchars($_GET['FirstRecord'], ENT_QUOTES, 'UTF-8') before echoing the value into HTML.
Implement a strict Content Security Policy that disallows inline scripts and restricts script sources to trusted origins.
Set the HttpOnly and Secure flags on session cookies to reduce the impact of successful script injection.
Consider migrating off version 1.0 if the vendor does not provide a patched release.

bash

# Example Apache mod_security rule to block XSS payloads targeting FirstRecord
SecRule ARGS:FirstRecord "@rx (?i)(<script|onerror=|javascript:|<iframe|<svg)" \
    "id:1002024,phase:2,deny,status:403,log,msg:'CVE-2024-3528 XSS attempt on units_view.php'"