Cyber Posture

CVE-2024-57428

CriticalPublic PoC

Published: 06 February 2025

Published
06 February 2025
Modified
24 June 2025
KEV Added
—
Patch
—
CVSS Score 9.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
EPSS Score 0.0201 83.8th percentile
Risk Priority 20 60% EPSS · 20% KEV · 20% CVSS

Description

Adversaries may gain access and continuously communicate with victims by injecting malicious content into systems through online network traffic.

Security Summary

CVE-2024-57428 is a stored cross-site scripting (XSS) vulnerability in PHPJabbers Cinema Booking System version 2.0. The flaw stems from unsanitized input in file upload fields (event_img, seat_maps) and seat number configurations (number[new_X] in pjActionCreate), enabling attackers to inject persistent JavaScript code. It is associated with CWE-79 and carries a CVSS v3.1 base score of 9.3 (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N).

Any unauthenticated attacker with network access can exploit this vulnerability by submitting malicious payloads through the affected input fields, though it requires user interaction for execution. Successful exploitation allows persistent JavaScript injection, which can lead to phishing attacks, malware delivery, and session hijacking against other users viewing the tainted content.

Advisories and further details are available in the GitHub repository at https://github.com/ahrixia/CVE-2024-57428, while the product page is at https://www.phpjabbers.com/cinema-booking-system/.

Details

CWE(s)
CWE-79

Affected Products

phpjabbers
cinema booking system
2.0

MITRE ATT&CK Enterprise Techniques

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1539 Steal Web Session Cookie Credential Access
An adversary may steal web application or service session cookies and use them to gain access to web applications or Internet services as an authenticated user without needing credentials.
attack.mitre.org →
T1659 Content Injection Initial Access
Adversaries may gain access and continuously communicate with victims by injecting malicious content into systems through online network traffic.
attack.mitre.org →
Why these techniques?

Stored XSS enables exploitation of a public-facing web application (T1190), persistent content injection via malicious JavaScript (T1659), and session hijacking through cookie theft (T1539).

References