CVE-2024-4518: School Management System XSS Vulnerability

CVE-2024-4518 Overview

CVE-2024-4518 is a reflected cross-site scripting (XSS) vulnerability in Campcodes Complete Web-Based School Management System 1.0. The flaw resides in /view/teacher_salary_invoice.php, where the desc parameter is rendered without proper sanitization. Attackers can inject arbitrary JavaScript that executes in the victim's browser session. The vulnerability requires user interaction and can be triggered remotely without authentication. Public disclosure of the exploit details has already occurred through VulDB entry #263122 and a GitHub proof-of-concept report.

Critical Impact
Attackers can execute arbitrary JavaScript in an authenticated user's browser, enabling session cookie theft, credential harvesting through fake login overlays, and unauthorized actions within the school management system.

Affected Products

Campcodes Complete Web-Based School Management System 1.0
/view/teacher_salary_invoice.php endpoint
Deployments exposing the desc GET/POST parameter to untrusted input

Discovery Timeline

2024-05-06 - CVE-2024-4518 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-4518

Vulnerability Analysis

The vulnerability is a reflected cross-site scripting flaw classified under [CWE-79]. The teacher_salary_invoice.php script accepts a desc parameter and reflects the value directly into the HTTP response body. Because the application does not apply output encoding or input sanitization, an attacker-controlled string containing HTML or JavaScript is interpreted by the browser as executable code.

Exploitation requires a victim, typically an authenticated administrator or accountant, to click a crafted URL. Once loaded, the injected payload executes under the origin of the school management system. This grants the attacker access to session cookies not marked HttpOnly, the DOM of privileged pages, and any actions the victim is authorized to perform.

Root Cause

The root cause is missing input validation and missing contextual output encoding on the desc request parameter. The application concatenates user-supplied data into HTML output without escaping characters such as <, >, ", and '. PHP applications typically remediate this class of bug using htmlspecialchars() with ENT_QUOTES and a defined character set.

Attack Vector

The attack vector is network-based and requires user interaction. An attacker crafts a URL of the form /view/teacher_salary_invoice.php?desc=<payload> and delivers it through phishing email, chat, or a malicious webpage. When a logged-in staff user opens the link, the payload executes with the privileges of that session. The scope is changed because scripts execute in the trusted origin of the application, allowing access to data outside the vulnerable component.

No verified exploit code has been curated for this article. See the GitHub XSS Vulnerability Report and the VulDB CVE-263122 Analysis for the publicly disclosed proof of concept.

Detection Methods for CVE-2024-4518

Indicators of Compromise

HTTP requests to /view/teacher_salary_invoice.php containing <script>, onerror=, onload=, javascript:, or URL-encoded equivalents in the desc parameter.
Referer headers pointing to external domains preceding requests to teacher_salary_invoice.php.
Web server access logs showing unusually long desc parameter values or repeated attempts with encoded payloads such as %3Cscript%3E.
Outbound requests from staff browsers to attacker-controlled hosts shortly after visiting a crafted invoice URL.

Detection Strategies

Deploy web application firewall (WAF) rules that inspect the desc parameter for HTML tags, event handlers, and script-related keywords.
Enable server-side logging of all GET and POST parameters submitted to /view/teacher_salary_invoice.php for offline analysis.
Correlate authentication events with anomalous JavaScript-triggered API calls originating from staff sessions.

Monitoring Recommendations

Ingest webserver access logs into a centralized analytics platform and alert on payload signatures matching common XSS vectors.
Track referer anomalies and unusual query-string lengths against the vulnerable endpoint.
Monitor for Content Security Policy (CSP) violation reports if CSP is enabled in report-only mode.

How to Mitigate CVE-2024-4518

Immediate Actions Required

Restrict network exposure of the school management system to trusted networks or place it behind a VPN until a patched build is available.
Deploy a WAF rule that blocks or sanitizes reflected script content in the desc parameter of /view/teacher_salary_invoice.php.
Instruct staff not to click invoice links received from untrusted sources and enforce browser session timeouts.
Rotate administrative credentials and invalidate active sessions if suspicious activity is observed.

Patch Information

No official vendor advisory or patch has been published by Campcodes at the time of writing. Administrators should apply source-level fixes to teacher_salary_invoice.php by sanitizing the desc parameter with htmlspecialchars($desc, ENT_QUOTES, 'UTF-8') before echoing it into HTML output. Review other pages in the application for the same output pattern, since the disclosure indicates multiple similar reports against this product.

Workarounds

Add a reverse-proxy or WAF signature that drops requests where desc contains <, >, or javascript: sequences.
Enforce a strict Content Security Policy that disables inline scripts and restricts script sources to same-origin trusted domains.
Set the HttpOnly and Secure flags on session cookies to reduce the impact of any successful script execution.
Disable or remove the teacher_salary_invoice.php endpoint if it is not required for business operations.

bash

# Example NGINX rule to block obvious XSS payloads in the desc parameter
location /view/teacher_salary_invoice.php {
    if ($arg_desc ~* "(<|%3C)[[:space:]]*script|javascript:|on[a-z]+=") {
        return 403;
    }
    proxy_pass http://backend;
}