CVE-2024-4074: Online Furniture Shopping Ecommerce XSS Flaw

CVE-2024-4074 Overview

CVE-2024-4074 is a reflected cross-site scripting (XSS) vulnerability in Kashipara Online Furniture Shopping Ecommerce Website 1.0. The flaw resides in prodInfo.php, where the prodId request parameter is reflected into the response without proper output encoding. An unauthenticated remote attacker can craft a malicious URL that executes arbitrary JavaScript in the victim's browser session when clicked. The weakness is tracked under CWE-79: Improper Neutralization of Input During Web Page Generation and was publicly disclosed through VulDB entry VDB-261800.

Critical Impact
Successful exploitation enables session hijacking, credential theft via injected forms, defacement, and client-side redirection to attacker-controlled infrastructure.

Affected Products

Aditya88 Online Furniture Shopping Ecommerce Website 1.0
prodInfo.php endpoint accepting the prodId parameter
Deployments distributed via the Kashipara project repository

Discovery Timeline

2024-04-23 - CVE-2024-4074 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-4074

Vulnerability Analysis

The vulnerability exists in the prodInfo.php script, which displays product details based on a prodId value supplied through the URL query string. The application concatenates this parameter directly into the HTML response without sanitization or contextual output encoding. As a result, any script payload supplied in prodId renders as executable markup inside the victim's browser.

Because the application runs over HTTP and does not require authentication for product browsing, exploitation requires only that a target click a crafted link. The reflected context typically changes the Document Object Model (DOM), allowing attackers to steal session cookies if HttpOnly is not set, hijack active sessions, or inject fake login prompts to harvest credentials.

Root Cause

The root cause is missing input validation and missing HTML entity encoding on the prodId parameter before it is embedded in the server-rendered page. The code path trusts user-controlled query parameters as safe for direct inclusion in HTML output, violating output encoding best practices mapped to CWE-79.

Attack Vector

The attack is network-based and requires user interaction. An attacker constructs a URL targeting prodInfo.php with a JavaScript payload supplied in prodId, then delivers it via phishing email, forum post, instant message, or malicious advertisement. When a victim loads the URL, the injected script runs under the origin of the vulnerable site. Technical reproduction details are documented in the GitHub CVE Project Document.

No verified public exploit code is bundled with this advisory. The vulnerability class is well understood: attacker-supplied markup in the prodId query parameter is echoed into the HTML response and executed by the browser.

Detection Methods for CVE-2024-4074

Indicators of Compromise

Web server access logs containing prodInfo.php requests with prodId values that include <script>, javascript:, onerror=, onload=, or URL-encoded equivalents such as %3Cscript%3E.
Outbound browser requests from internal users to unexpected domains immediately after visiting the furniture site, suggesting cookie exfiltration.
Spikes in referer headers pointing to the vulnerable endpoint from external phishing domains.

Detection Strategies

Deploy a Web Application Firewall (WAF) rule set, such as OWASP Core Rule Set, to flag reflected XSS patterns on query parameters.
Perform authenticated and unauthenticated scans with tools like OWASP ZAP or Burp Suite against prodInfo.php using XSS payload lists.
Implement Content Security Policy (CSP) violation reporting to surface unexpected inline script execution from the application origin.

Monitoring Recommendations

Alert on HTTP 200 responses to prodInfo.php where the response body contains the unencoded prodId value supplied in the request.
Correlate suspicious URL parameters with downstream events such as session token reuse from new IP addresses or geolocations.
Monitor for sudden increases in traffic to prodInfo.php from external referrers, which may indicate active phishing campaigns leveraging CVE-2024-4074.

How to Mitigate CVE-2024-4074

Immediate Actions Required

Inventory any production or staging deployments of Aditya88 Online Furniture Shopping Ecommerce Website 1.0 and restrict external access until mitigations are in place.
Deploy virtual patching through a WAF to block requests containing script tags or event-handler syntax in the prodId parameter.
Rotate active user session cookies and force re-authentication to invalidate any sessions potentially stolen through exploitation.

Patch Information

No official vendor patch is referenced in the CVE record or available vendor advisories. Operators should apply code-level fixes locally: validate prodId as a numeric identifier and apply contextual output encoding using functions such as htmlspecialchars($prodId, ENT_QUOTES, 'UTF-8') before echoing the value into HTML. Review all other parameters processed by the application for the same class of flaw.

Workarounds

Enforce a strict Content-Security-Policy header, for example default-src 'self'; script-src 'self', to prevent execution of injected inline scripts.
Set the HttpOnly and Secure flags on session cookies to limit the impact of stolen tokens from client-side script.
Add server-side input validation that rejects any prodId value not matching a numeric regular expression such as ^[0-9]+$.
If the application is non-essential or unmaintained, decommission it and migrate to a supported ecommerce platform.

bash

# Example Nginx WAF-style block for reflected XSS payloads targeting prodId
if ($args ~* "prodId=[^&]*(<|%3C)\s*script") {
    return 403;
}