LinZhaoguan pb-cms Comment cross site scripting

Successful exploitation of CVE-2024-0776 allows an attacker to execute arbitrary JavaScript code within the context of a victim's browser session. This can lead to various malicious actions, including stealing cookies, redirecting users to phishing sites, or defacing the website. The remote nature of the vulnerability means an attacker doesn't need local access to exploit it. The impact is amplified if the pb-cms installation handles sensitive user data or financial transactions, as attackers could potentially gain access to this information. While the CVSS score is LOW, the ease of exploitation and potential for session hijacking make this a significant risk.

Websites and applications utilizing pb-cms version 2.0 are at risk. This includes developers who have integrated pb-cms into their projects and hosting providers who manage pb-cms installations for their clients. Shared hosting environments are particularly vulnerable as multiple websites may be affected by a single instance of the vulnerable software.

• php: Examine pb-cms configuration files for any custom sanitization routines that might be bypassed. • generic web: Monitor access logs for unusual requests containing the payload <div onmouseenter="alert("xss")">. • generic web: Check response headers for signs of script injection (e.g., unexpected Content-Security-Policy directives).

1. 2024-01-22Disclosure

   disclosure

1. 已保留2024-01-21
2. 发布日期2024-01-22
3. 修改日期2025-06-17
4. EPSS 更新日期2026-04-02

The primary mitigation for CVE-2024-0776 is to immediately upgrade pb-cms to version 2.0.1, which contains the fix. If upgrading is not immediately feasible, consider implementing input validation and sanitization on the Comment Handler to prevent the injection of malicious scripts. Web Application Firewalls (WAFs) configured to detect and block XSS payloads can provide an additional layer of defense. Regularly review and update security rules to reflect the latest threat landscape. After upgrade, confirm the vulnerability is resolved by attempting to inject the test payload (<div onmouseenter="alert("xss")">) and verifying that the alert does not trigger.