CVE-2024-4649: School Management System XSS Vulnerability

CVE-2024-4649 Overview

CVE-2024-4649 is a reflected cross-site scripting (XSS) vulnerability [CWE-79] in Campcodes Complete Web-Based School Management System 1.0. The flaw resides in /view/student_exam_mark_insert_form1.php, where the page parameter is reflected into the response without proper sanitization. Attackers can craft a malicious URL that, when visited by an authenticated user, executes arbitrary JavaScript in the browser session. The exploit details have been publicly disclosed under VulDB identifier VDB-263493, increasing the likelihood of opportunistic abuse against exposed deployments.

Critical Impact
Successful exploitation enables session hijacking, credential theft through fake login overlays, and administrative action forgery against school administrators who click a crafted link.

Affected Products

Campcodes Complete Web-Based School Management System 1.0
Deployments exposing /view/student_exam_mark_insert_form1.php
Any downstream fork retaining the vulnerable page parameter handling

Discovery Timeline

2024-05-08 - CVE-2024-4649 published to the National Vulnerability Database
2026-06-17 - Last updated in the NVD database

Technical Details for CVE-2024-4649

Vulnerability Analysis

The vulnerability is a reflected XSS flaw in the exam mark entry form of the school management application. The page HTTP GET parameter received by /view/student_exam_mark_insert_form1.php is written back into the rendered HTML without output encoding or input validation. An attacker who tricks an authenticated user into following a crafted link can execute arbitrary JavaScript in the context of the application origin. Because the application handles sensitive student records and administrative functions, injected scripts can read session cookies, submit forged requests on behalf of staff, or redirect users to attacker-controlled infrastructure. The user interaction requirement and limited confidentiality and integrity impact align with the medium severity rating.

Root Cause

The root cause is missing contextual output encoding on a user-controlled query parameter. The page value is interpolated directly into HTML without using an encoding routine such as htmlspecialchars() with the ENT_QUOTES flag. There is no server-side allowlist validation on the parameter value, and no Content Security Policy (CSP) is enforced to constrain inline script execution.

Attack Vector

Exploitation is remote and requires user interaction. An attacker constructs a URL containing a JavaScript payload in the page parameter and delivers it through phishing, forum posts, or malicious advertising. When an authenticated school administrator opens the link, the payload executes under the application origin and can access any data the user is authorized to view. No prior authentication is required by the attacker, and no special privileges are needed on the target server.

No verified exploit code is published alongside the CVE record. Technical details are available in the GitHub XSS Vulnerability Report and the VulDB entry #263493.

Detection Methods for CVE-2024-4649

Indicators of Compromise

HTTP GET requests to /view/student_exam_mark_insert_form1.php where the page parameter contains <script>, onerror=, javascript:, or percent-encoded variants such as %3Cscript%3E.
Referrer headers originating from external domains delivering URLs with suspicious page payloads.
Unexpected outbound requests from administrator browsers to unknown domains following access to the exam mark form.

Detection Strategies

Deploy web application firewall (WAF) signatures that inspect query string parameters for XSS payload patterns targeting the page argument.
Hunt in web server access logs for anomalously long or encoded page values on the vulnerable endpoint.
Correlate session cookie use across multiple source IP addresses in short time windows, which can indicate token theft.

Monitoring Recommendations

Forward Apache or Nginx access logs into a centralized analytics platform for query string anomaly detection.
Enable browser-side CSP violation reporting to surface injection attempts in real time.
Alert on authenticated administrative sessions that trigger unusual record modifications shortly after accessing the exam mark form.

How to Mitigate CVE-2024-4649

Immediate Actions Required

Restrict access to /view/student_exam_mark_insert_form1.php to trusted internal networks or VPN clients until a patch is applied.
Apply a WAF rule that blocks requests where the page parameter contains HTML or script metacharacters.
Instruct administrators to avoid clicking links that reference the school management application from untrusted sources.

Patch Information

No vendor advisory or official patch has been published by Campcodes for CVE-2024-4649 at the time of writing. Operators should monitor the vendor's distribution channel for updates and consider applying a code-level fix that encodes the page parameter with htmlspecialchars($_GET['page'], ENT_QUOTES, 'UTF-8') before rendering.

Workarounds

Enforce a strict Content Security Policy that disallows inline scripts and restricts script sources to the application origin.
Set the HttpOnly and Secure flags on session cookies to limit the impact of script-based cookie theft.
Implement server-side input validation that rejects page values not matching an expected allowlist of pagination tokens.

bash

# Example ModSecurity rule to block XSS payloads in the page parameter
SecRule ARGS:page "@rx (?i)(<script|onerror=|javascript:|%3Cscript)" \
    "id:1004649,phase:2,deny,status:403,log,\
    msg:'CVE-2024-4649 XSS attempt on student_exam_mark_insert_form1.php'"