CVE-2024-49705: Softcom.wroc Iksoris Client-Side DoS Vulnerability

CVE-2024-49705 Overview

CVE-2024-49705 affects Internet Starter, a module of the SoftCOM iKSORIS ticket reservation and sales system. The vulnerability allows an attacker to trigger a persistent client-side Denial of Service (DoS) condition by tricking a user into visiting a crafted URL containing a d parameter set to an unhandled value. Because the parameter is stored in a session cookie, the affected session remains broken until the cookie expires or is deleted manually. A comparable outcome is possible when a user attempts to switch the platform language to an unimplemented one. The issue is tracked under [CWE-248 Uncaught Exception] and is patched in version 79.0.

Critical Impact
A single malicious link renders the application unusable for the targeted user throughout the lifetime of their session cookie.

Affected Products

SoftCOM iKSORIS Internet Starter module
iKSORIS ticket reservation and sales system versions prior to 79.0
Deployments relying on session cookies to persist the d parameter

Discovery Timeline

2025-04-14 - CVE-2024-49705 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-49705

Vulnerability Analysis

The flaw resides in how Internet Starter processes the d query parameter. The server accepts arbitrary values for d without validating them against a list of supported options. When an unhandled value is supplied, the backend raises an exception that halts subsequent request processing rather than returning a controlled error and resetting state. This behavior is characteristic of [CWE-248] Uncaught Exception. Because the offending value is persisted inside the session cookie, every follow-up request replays the same faulty state, keeping the user locked out until the session terminates. The same failure mode occurs when a user selects a language identifier that is not implemented on the platform.

Root Cause

The root cause is missing input validation on the d parameter and the language selector combined with unsafe session persistence. Values that should be rejected at the request boundary are instead written into the session and rehydrated on every request, converting a transient input error into a durable session-level DoS.

Attack Vector

Exploitation requires user interaction. An attacker crafts a URL containing an invalid d value and delivers it via phishing, chat, or a link on an attacker-controlled page. Once the victim clicks the link, the malformed value is written into their session cookie, and the Internet Starter module returns errors for all further requests within that session.

No verified proof-of-concept code is published for CVE-2024-49705.
Refer to the CERT PL advisory for technical detail:
https://cert.pl/en/posts/2025/04/CVE-2024-10087

Detection Methods for CVE-2024-49705

Indicators of Compromise

Repeated HTTP responses returning application error pages tied to a specific session identifier.
Session cookies containing unexpected or out-of-range values for the d parameter.
Bursts of user complaints about the Internet Starter portal returning errors immediately after clicking an external link.

Detection Strategies

Inspect web server and application logs for requests containing a d query parameter with values outside the documented allow list.
Correlate referrer headers pointing to external or suspicious domains with subsequent error responses from the iKSORIS backend.
Monitor language selection endpoints for requests specifying language codes that the platform does not implement.

Monitoring Recommendations

Alert on sustained HTTP 4xx or 5xx error rates scoped to a single session cookie or user identifier.
Track distinct values of the d parameter over time and flag new or malformed values for review.
Enable telemetry forwarding from the web tier to a centralized log platform to preserve session-level context for investigation.

How to Mitigate CVE-2024-49705

Immediate Actions Required

Upgrade the iKSORIS Internet Starter module to version 79.0 or later, which contains the vendor fix.
Instruct affected users to clear cookies or wait for session expiration to recover access after exposure.
Review perimeter controls to filter inbound links that supply unexpected d parameter values to the application.

Patch Information

SoftCOM has patched CVE-2024-49705 in iKSORIS Internet Starter version 79.0. Refer to the CERT PL advisory and the iKSORIS product page for vendor context and update guidance.

Workarounds

Deploy a reverse proxy or web application firewall rule that rejects requests where the d parameter is not in an approved allow list.
Shorten session cookie lifetimes so that a poisoned session self-recovers more quickly.
Provide end users with a documented procedure to clear the iKSORIS session cookie if the interface begins returning persistent errors.

bash

# Example WAF rule concept: drop requests with unexpected 'd' parameter values
# Adjust the allow list to match values supported by your iKSORIS deployment
if ($arg_d !~* "^(1|2|3|pl|en)$") {
    return 400;
}