Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
Sources: National Vulnerability Database, CISA KEV, Exploit-DB
CVE-2024-5897 Overview
CVE-2024-5897 is a reflected cross-site scripting (XSS) vulnerability in SourceCodester Employee and Visitor Gate Pass Logging System 1.0. The flaw resides in the /classes/Master.php?f=log_visitor endpoint, where the name parameter is rendered without proper output encoding. Attackers can inject arbitrary JavaScript that executes in the browser context of any user who views the manipulated data. The issue was disclosed publicly through VulDB (identifier VDB-268141) and is tracked under [CWE-79]. The attack is remotely exploitable and requires no authentication, enabling session theft, credential harvesting, and client-side action abuse.
Critical Impact
Unauthenticated remote attackers can inject JavaScript into the visitor logging workflow, enabling session hijacking and malicious actions executed in the context of authenticated administrators.
Affected Products
- Oretnom23 (SourceCodester) Employee and Visitor Gate Pass Logging System 1.0
- Vulnerable endpoint: /classes/Master.php?f=log_visitor
- Vulnerable parameter: name
Discovery Timeline
- 2024-06-12 - CVE-2024-5897 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-5897
Vulnerability Analysis
The Employee and Visitor Gate Pass Logging System fails to sanitize user input submitted to the log_visitor function in Master.php. The name parameter is reflected back into application responses and rendered by the browser as HTML. An attacker supplies a crafted payload containing script tags or JavaScript event handlers. When an administrator reviews visitor logs, the stored or reflected payload executes in the authenticated session context.
This is a classic input validation failure categorized under [CWE-79] (Improper Neutralization of Input During Web Page Generation). The application treats user-controlled strings as trusted markup rather than literal text. See the GitHub XSS proof-of-concept writeup for technical details.
Root Cause
The root cause is missing output encoding on the name field within the visitor logging handler. The application does not call HTML entity encoding or input filtering before echoing the parameter back to the user interface. No Content Security Policy (CSP) is enforced to restrict inline script execution.
Attack Vector
The vulnerability is reachable over the network with no authentication and no user interaction beyond normal application use by a victim. An attacker submits a visitor log entry containing a JavaScript payload in the name field. When the record is rendered in the administrative dashboard, the payload executes. Exploitation can lead to session cookie theft, forced administrative actions, and phishing content delivery.
No verified exploitation code is published in a hardened format. The vulnerability mechanism is described in the referenced VulDB entry 268141.
Detection Methods for CVE-2024-5897
Indicators of Compromise
- Visitor log entries containing HTML tags, <script> elements, javascript: URIs, or event handler attributes such as onerror= and onload=.
- Outbound HTTP requests from administrator browsers to attacker-controlled domains shortly after accessing visitor logs.
- Unexpected session token exfiltration or administrator account activity originating from unfamiliar IP addresses.
Detection Strategies
- Inspect HTTP POST bodies to /classes/Master.php?f=log_visitor for payloads containing angle brackets, encoded script delimiters, or common XSS vectors.
- Deploy a web application firewall (WAF) rule set that matches OWASP Core Rule Set signatures for reflected and stored XSS.
- Review web server access logs for anomalous name parameter values exceeding typical length or containing non-printable characters.
Monitoring Recommendations
- Enable browser-side CSP violation reporting for the administrative interface to surface injected inline scripts.
- Alert on administrator session cookies being accessed from new user-agent or geolocation combinations.
- Monitor database rows in the visitors table for stored HTML content that should contain plain text names only.
How to Mitigate CVE-2024-5897
Immediate Actions Required
- Restrict network access to the Employee and Visitor Gate Pass Logging System to trusted internal networks or VPN users.
- Apply input validation on the name parameter at the web server or WAF layer, rejecting requests containing HTML metacharacters.
- Audit existing visitor records for stored payloads and purge entries containing script content.
Patch Information
No official vendor patch is listed in the NVD advisory. SourceCodester has not published a fixed release addressing CVE-2024-5897 at the time of this writing. Organizations should treat the product as unpatched and consider replacement with a maintained alternative. Monitor the VulDB advisory for update notifications.
Workarounds
- Place the application behind a WAF with XSS filtering rules enforced on all parameters.
- Modify /classes/Master.php to apply htmlspecialchars($name, ENT_QUOTES, 'UTF-8') before storing or rendering the name field.
- Enforce a strict Content Security Policy that disallows inline scripts and limits script sources to the application origin.
- Set the HttpOnly and Secure flags on all session cookies to limit the impact of script-based cookie theft.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
Sources: National Vulnerability Database, CISA KEV, Exploit-DB
