CVE-2024-57428

An attacker can inject malicious JavaScript code into file upload fields (event_img, seat_maps) and into seat numbering parameters (number[new_X] in the pjActionCreate action), which are not properly filtered or encoded. The injected payload is permanently stored on the server side and executed in the browser of every user viewing the infected page. The vulnerability operates persistently — it does not require tricking the victim into visiting a specially crafted URL, as the malicious code is served directly from the application.

An attacker can conduct phishing, inject malware, and hijack sessions of authenticated users, thereby gaining access to their accounts and data.

Patches available from the vendor should be applied in accordance with the references. Until the update is applied, it is recommended to restrict access to file upload functions and venue configuration exclusively to trusted users and implement a Content-Security-Policy header as an additional layer of protection.

PHPJabbers Cinema Booking System v2.0