CVE-2024-8604: Online Food Ordering System XSS Vulnerability

CVE-2024-8604 Overview

CVE-2024-8604 is a reflected cross-site scripting (XSS) vulnerability in SourceCodester Online Food Ordering System 2.0. The flaw resides in the index.php file within the Create an Account page component. Attackers can inject malicious script payloads through the First Name and Last Name parameters. The manipulation triggers script execution in the browser context of any user rendering the affected content.

The vulnerability is remotely exploitable and requires no authentication or user interaction beyond visiting a crafted page. Public disclosure occurred through VulDB submission #404660, and the issue is categorized under CWE-79: Improper Neutralization of Input During Web Page Generation.

Critical Impact
Remote attackers can execute arbitrary JavaScript in victim browsers, enabling session hijacking, credential theft, and phishing against users of the Online Food Ordering System.

Affected Products

Oretnom23 (SourceCodester) Online Food Ordering System 2.0
index.php — Create an Account Page component
First Name and Last Name input parameters

Discovery Timeline

2024-09-09 - CVE-2024-8604 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-8604

Vulnerability Analysis

The vulnerability is a reflected cross-site scripting flaw classified under [CWE-79]. The Create an Account page in index.php accepts user-supplied values for First Name and Last Name without applying output encoding or input sanitization. When the application echoes these values back into the HTML response, the browser interprets injected <script> payloads as executable code.

Exploitation succeeds over the network with no authentication. An attacker crafts a URL or form submission containing a JavaScript payload in the name fields, then delivers the link through phishing or a malicious page. Once the victim loads the response, the payload executes under the origin of the vulnerable application.

Successful exploitation impacts confidentiality and integrity of the user session. Attackers can steal session cookies, harvest credentials from the account creation form, redirect users to attacker-controlled pages, or perform actions on behalf of the authenticated victim.

Root Cause

The root cause is missing input validation and output encoding on the First Name and Last Name parameters processed by index.php. The application trusts user input and reflects it into the HTML response without escaping HTML control characters such as <, >, and ".

Attack Vector

The attack vector is network-based. An attacker constructs a malicious HTTP request targeting the Create an Account endpoint with a script payload embedded in the name fields. The payload executes when the response is rendered in the victim's browser. No prior privileges or user interaction beyond visiting the link are required.

See the VulDB entry #276831 for the original submission details.

Detection Methods for CVE-2024-8604

Indicators of Compromise

HTTP requests to index.php containing <script>, onerror=, onload=, or javascript: sequences within the First Name or Last Name parameters.
Web server access logs showing URL-encoded payloads such as %3Cscript%3E targeting the Create an Account page.
Unexpected outbound requests from user browsers to unfamiliar domains following visits to the account registration page.

Detection Strategies

Deploy a web application firewall (WAF) with rules that inspect POST and GET parameters for common XSS signatures on the account registration endpoint.
Perform dynamic application security testing (DAST) against the index.php Create an Account form using XSS-focused payload sets.
Review server-side logs for anomalous character sequences in name-related form fields.

Monitoring Recommendations

Enable and monitor Content Security Policy (CSP) violation reports to identify blocked inline script execution attempts.
Alert on repeated failed account creations from a single source containing HTML control characters.
Correlate WAF blocks against the registration endpoint with downstream authentication and session events.

How to Mitigate CVE-2024-8604

Immediate Actions Required

Restrict public access to the Online Food Ordering System 2.0 registration page until a fix is applied, using network ACLs or authentication proxies.
Deploy WAF rules that block HTML and JavaScript metacharacters in the First Name and Last Name parameters submitted to index.php.
Audit existing user accounts for entries containing suspicious characters in name fields and remove or sanitize them.

Patch Information

No vendor patch has been published for SourceCodester Online Food Ordering System 2.0 at the time of NVD publication. Refer to the SourceCodester Resource Hub for future updates and consult the VulDB CTI record #276831 for tracking information.

Workarounds

Modify index.php to apply server-side input validation that rejects HTML control characters in name fields, and encode all reflected output using functions such as htmlspecialchars() with ENT_QUOTES.
Implement a strict Content Security Policy that disallows inline scripts and restricts script sources to trusted origins.
Set the HttpOnly and Secure flags on session cookies to reduce the impact of script-based session theft.

bash

# Configuration example: Apache mod_security rule to block script tags in name parameters
SecRule ARGS:firstname|ARGS:lastname "@rx (?i)(<script|javascript:|onerror=|onload=)" \
    "id:1008604,phase:2,deny,status:403,msg:'CVE-2024-8604 XSS attempt blocked'"

# Example CSP response header
Header set Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'"