SourceCodester Online Job Portal Manage Job Page ManageJob.php cross site scripting

Successful exploitation of CVE-2024-1922 allows an attacker to inject arbitrary JavaScript code into the Online Job Portal. This could be used to steal user credentials (usernames, passwords, session cookies), redirect users to malicious websites, or deface the job portal's pages. The impact is amplified if the portal handles sensitive user data, such as resumes or personal information. While the CVSS score is LOW, the ease of exploitation and potential for data theft make this a significant concern, particularly for portals with a large user base or those handling confidential information. The public disclosure increases the risk of immediate exploitation.

Organizations and individuals using SourceCodester Online Job Portal version 1.0 are at risk. This includes small businesses, startups, and job boards that rely on this platform for managing job postings and applicant information. Shared hosting environments where multiple users share the same server are particularly vulnerable, as an attacker could potentially compromise other users' accounts through this vulnerability.

• php: Examine the /Employer/ManageJob.php file for unsanitized input handling of the Qualification/Description parameter. Search for instances where user input is directly outputted to the page without proper encoding.

// Example of vulnerable code
<?php
echo $_GET['Qualification']; ?>

• generic web: Monitor access logs for unusual GET requests to /Employer/ManageJob.php with suspicious parameters in the Qualification/Description field. Look for patterns indicative of XSS payloads (e.g., <script>, javascript:).

grep 'Qualification=[^>]+script[^<]' access.log

• generic web: Check response headers for the presence of X-XSS-Protection or Content-Security-Policy headers. Absence of these headers indicates a lack of XSS protection. • generic web: Use a web vulnerability scanner to automatically identify and test for XSS vulnerabilities in the Online Job Portal.

1. 2024-02-27Disclosure

   disclosure

2. 2024-02-27Patch

   patch

1. Réservé2024-02-27
2. Publiée2024-02-27
3. Modifiée2024-08-01
4. EPSS mis à jour2026-04-02

The primary mitigation for CVE-2024-1922 is to immediately upgrade to version 1.0.1 of SourceCodester Online Job Portal. If upgrading is not immediately feasible, consider implementing input validation and output encoding on the Qualification/Description field to sanitize user-supplied data. Web application firewalls (WAFs) configured to detect and block XSS payloads can provide an additional layer of defense. Regularly review and update the job portal's code to prevent future vulnerabilities. After upgrading, confirm the vulnerability is resolved by attempting to inject a simple JavaScript payload into the Qualification/Description field and verifying that it is not executed.