CVE-2024-1919 - SourceCodester Online Job Portal 1.: XSS vulnerability in Manage Walkin Page

A vulnerability, classified as problematic, was recently discovered in SourceCodester Online Job Portal 1. system. This vulnerability affects the unknown code within the file /Employer/ManageWalkin.php of the Manage Walkin Page component of the application. By manipulating the argument "Job Title", it allows a potential attacker to exploit this cross-site scripting (XSS) vulnerability. The attack can be initiated remotely and the exploit has been disclosed to the public, which means it may be used by malicious individuals. The identifier assigned to this vulnerability is VDB-254854.

Exploit Details

The /Employer/ManageWalkin.php file contains an unknown code that handles the "Job Title" argument. An attacker can inject malicious scripts into the argument to gain access to sensitive user information, steal session cookies, or even take control of the user's browser settings.

The vulnerable code snippet in /Employer/ManageWalkin.php may look something like this

$jobTitle = $_GET['JobTitle'];
echo $jobTitle;

An attacker could exploit this vulnerability by visiting a crafted URL with injected script in the "Job Title" parameter, for example:

http://example.com/Employer/ManageWalkin.php?JobTitle=<script>alert(1)</script>;

Upon visiting this URL, the malicious script in the "Job Title" parameter will be executed, triggering the XSS.

Affected Versions

This vulnerability has been found in SourceCodester Online Job Portal 1.. It is recommended to check and verify if other versions are also affected.

To learn more about this vulnerability and its details, please visit the following links

- Vulnerability Disclosure
- SourceCodester Project

Mitigation

To mitigate this vulnerability, it is recommended to sanitize and validate user inputs and strictly encode and escape the output displayed in a web page, especially when dealing with dynamic content.

For instance, in /Employer/ManageWalkin.php, you can use htmlspecialchars() in PHP to sanitize the "Job Title" input:

$jobTitle = htmlspecialchars($_GET['JobTitle'], ENT_QUOTES, 'UTF-8');
echo $jobTitle;

This will prevent the injected script from being executed.

Moreover, it is suggested to keep your application up to date and apply patches or fixes provided by SourceCodester when available.

Conclusion

The CVE-2024-1919 vulnerability in SourceCodester Online Job Portal 1. can lead to significant security issues if not patched or mitigated. Ensure that you protect your system and your users' information by following the mentioned mitigation steps and keeping your application up to date. Be cautious of publicly disclosed exploits, and always pay attention to potential security flaws in any system you are using.

Timeline

Published on: 02/27/2024 14:15:27 UTC
Last modified on: 03/21/2024 02:51:49 UTC