CodeAstro Internet Banking System pages_client_signup.php cross site scripting

Successful exploitation of CVE-2024-0773 allows an attacker to inject arbitrary JavaScript code into the Internet Banking System. This can lead to session hijacking, phishing attacks, and the theft of sensitive user information, such as login credentials and financial data. The attacker could potentially redirect users to malicious websites or deface the application's interface. Given the nature of internet banking systems, the potential impact is significant, potentially leading to financial losses and reputational damage for both the bank and its customers. The remote nature of the attack makes it easily exploitable.

Financial institutions and businesses utilizing CodeAstro Internet Banking System version 1.0 are at immediate risk. Shared hosting environments where multiple websites share the same server resources are particularly vulnerable, as an attacker could potentially exploit this vulnerability on one website to gain access to others. Legacy systems that have not been regularly patched or updated are also at higher risk.

• php / web:

 grep -r "pages_client_signup.php" /var/www/html/

• generic web:

curl -I https://your-internet-banking-system/pages_client_signup.php?Client Full Name=<script>alert(1)</script>

• generic web:

 grep -A 10 "pages_client_signup.php" /var/log/apache2/access.log

1. 2024-01-21Disclosure

   disclosure

1. Reserviert2024-01-21
2. Veröffentlicht2024-01-21
3. Geändert2025-05-30
4. EPSS aktualisiert2026-04-02

The primary mitigation for CVE-2024-0773 is to immediately upgrade to version 1.0.1 of the CodeAstro Internet Banking System. Prior to upgrading, it's recommended to create a full backup of the system, including the database and application files. If an upgrade is not immediately feasible, consider implementing input validation and sanitization on the 'Client Full Name' field to prevent malicious script injection. Web application firewalls (WAFs) can also be configured to filter out potentially malicious requests targeting the vulnerable endpoint. After upgrading, confirm the vulnerability is resolved by attempting to inject a simple JavaScript payload into the 'Client Full Name' field and verifying that it is not executed.