CVE-2024-0773: XSS in Internet Banking System 1.0

Successful exploitation of CVE-2024-0773 allows an attacker to inject arbitrary JavaScript code into the Internet Banking System. This can lead to session hijacking, phishing attacks, and the theft of sensitive user information, such as login credentials and financial data. The attacker could potentially redirect users to malicious websites or deface the application's interface. Given the nature of internet banking systems, the potential impact is significant, potentially leading to financial losses and reputational damage for both the bank and its customers. The remote nature of the attack makes it easily exploitable.

1. Reserved2024-01-21
2. Published2024-01-21
3. Modified2025-05-30
4. EPSS updated2026-04-02

The primary mitigation for CVE-2024-0773 is to immediately upgrade to version 1.0.1 of the CodeAstro Internet Banking System. Prior to upgrading, it's recommended to create a full backup of the system, including the database and application files. If an upgrade is not immediately feasible, consider implementing input validation and sanitization on the 'Client Full Name' field to prevent malicious script injection. Web application firewalls (WAFs) can also be configured to filter out potentially malicious requests targeting the vulnerable endpoint. After upgrading, confirm the vulnerability is resolved by attempting to inject a simple JavaScript payload into the 'Client Full Name' field and verifying that it is not executed.