Kashipara Food Management System addmaterialsubmit.php cross site scripting

Successful exploitation of CVE-2024-0282 allows an attacker to execute arbitrary JavaScript code within the context of a user's browser session. This can lead to various malicious outcomes, including stealing user credentials, redirecting users to phishing sites, or defacing the application's interface. The vulnerability resides in the addmaterialsubmit.php file, specifically within the handling of the tin parameter. The attacker can manipulate this parameter to inject malicious code that will be executed when a user views the affected page. Given the public disclosure of this exploit, the risk of immediate exploitation is elevated.

Organizations utilizing Kashipara Food Management System in their operations, particularly those with publicly accessible instances, are at risk. Shared hosting environments where multiple users share the same server instance are also at increased risk, as a compromise of one user's account could potentially lead to the compromise of others.

• php / web:

grep -r "tin = [^\"]*" /var/www/kashipara_food_management_system/

• generic web:

curl -I http://your-website.com/addmaterialsubmit.php?tin=<script>alert('XSS')</script>

• generic web: Check access logs for unusual requests to addmaterialsubmit.php with suspicious parameters in the tin field. • generic web: Monitor browser console for JavaScript errors related to XSS payloads.

1. 2024-01-07Disclosure

   disclosure

1. 已保留2024-01-06
2. 发布日期2024-01-07
3. 修改日期2025-04-17
4. EPSS 更新日期2026-04-02

The primary mitigation for CVE-2024-0282 is to upgrade Kashipara Food Management System to version 1.0.1 or later, which contains the necessary fix. If upgrading is not immediately feasible, consider implementing input validation and sanitization on the tin parameter within addmaterialsubmit.php to prevent the injection of malicious scripts. Web application firewalls (WAFs) configured to detect and block XSS payloads can also provide a temporary layer of protection. After upgrading, verify the fix by attempting to inject a simple XSS payload (e.g., <script>alert('XSS')</script>) through the tin parameter and confirming that it is properly neutralized.