CVE-2024-1029: XSS in Cogites eReserv 7.7.58

Successful exploitation of CVE-2024-1029 allows an attacker to inject arbitrary JavaScript code into the eReserv application. This can lead to various malicious outcomes, including session hijacking, defacement of the application's interface, and theft of sensitive user data, such as login credentials or personally identifiable information (PII). The attacker could potentially gain control over administrative accounts if they can successfully inject and execute malicious code within the administrative interface. The remote nature of the vulnerability means that attackers do not need to be on the same network as the eReserv server to exploit it.

1. Reserved2024-01-29
2. Published2024-01-30
3. Modified2025-06-17
4. EPSS updated2026-04-02

The primary mitigation for CVE-2024-1029 is to upgrade Cogites eReserv to version 7.7.59 or later, which contains the fix for this vulnerability. If upgrading immediately is not possible, consider implementing input validation and sanitization on the 'Nom' parameter within the /front/admin/tenancyDetail.php file to prevent malicious input. Web application firewalls (WAFs) configured to detect and block XSS attacks can also provide a temporary layer of protection. Carefully review and validate all user inputs to prevent injection attacks. After upgrading, confirm the vulnerability is resolved by attempting to inject a simple XSS payload (e.g., <script>alert('XSS')</script>) into the 'Nom' field and verifying that the script is not executed.