CodeAstro Vehicle Booking System Feedback Page user-give-feedback.php cross site scripting

Successful exploitation of CVE-2024-0346 enables an attacker to execute arbitrary JavaScript code within the context of a user's browser session. This can lead to various malicious actions, including session hijacking, credential theft, and defacement of the Vehicle Booking System's web interface. An attacker could potentially redirect users to phishing sites, steal sensitive information entered into forms, or inject malicious content that appears to originate from the legitimate application. The blast radius is limited to users interacting with the feedback page, but the impact on individual users can be significant.

Organizations utilizing CodeAstro Vehicle Booking System version 1.0 are at risk. This includes businesses relying on the system for managing vehicle bookings and customer feedback. Shared hosting environments where multiple websites share the same server resources are particularly vulnerable, as a compromise of one website could potentially impact others.

• php: Examine the usr/user-give-feedback.php file for inadequate input validation on the My Testemonial parameter. Search for instances where user-supplied data is directly outputted to the page without proper encoding. • generic web: Monitor access logs for unusual requests to usr/user-give-feedback.php containing suspicious characters or patterns commonly associated with XSS payloads (e.g., <script>, <iframe>). • generic web: Check response headers for the presence of Content Security Policy (CSP) directives. A properly configured CSP can mitigate the impact of XSS vulnerabilities.

1. 2024-01-09Disclosure

   disclosure

1. Gereserveerd2024-01-09
2. Gepubliceerd2024-01-09
3. Gewijzigd2024-09-03
4. EPSS bijgewerkt2026-04-02

The primary mitigation for CVE-2024-0346 is to immediately upgrade the CodeAstro Vehicle Booking System to version 1.0.1 or later. If upgrading is not immediately feasible, consider implementing input validation and output encoding on the My Testemonial parameter within the usr/user-give-feedback.php file. This can help prevent the injection of malicious scripts. Web application firewalls (WAFs) configured to detect and block XSS payloads can also provide a temporary layer of protection. After upgrading, confirm the vulnerability is resolved by attempting to inject a simple XSS payload (e.g., <script>alert(1)</script>) into the feedback form and verifying that the script is not executed.