CVE-2014-2024 in Open Classifieds 2
Summary
by MITRE
Cross-site scripting (XSS) vulnerability in classes/controller/error.php in Open Classifieds 2 before 2.1.3 allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO to shared-apartments-rooms/.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 05/08/2026
The vulnerability identified as CVE-2014-2024 represents a critical cross-site scripting flaw within the Open Classifieds 2 web application platform. This security weakness exists in the error handling mechanism located within the classes/controller/error.php file, specifically affecting versions prior to 2.1.3. The vulnerability manifests when the application processes PATH_INFO parameters through the shared-apartments-rooms/ endpoint, creating an avenue for malicious actors to execute arbitrary web scripts or HTML code within the context of other users' browsers.
The technical implementation of this vulnerability stems from insufficient input validation and output sanitization within the error controller's handling of PATH_INFO parameters. When the application encounters an error condition while processing requests to the shared-apartments-rooms/ path, it fails to properly escape or filter user-supplied input before rendering it in the error response. This creates a classic XSS attack vector where an attacker can craft malicious URL parameters containing script code that gets executed when other users view the error page. The flaw aligns with CWE-79, which specifically addresses cross-site scripting vulnerabilities resulting from improper sanitization of user-controllable input.
The operational impact of this vulnerability extends beyond simple script injection, as it enables attackers to perform various malicious activities including session hijacking, credential theft, and redirection to malicious sites. An attacker could craft a URL containing malicious JavaScript that, when visited by another user, would execute in their browser context and potentially steal session cookies or other sensitive information. The vulnerability affects the entire user base of affected Open Classifieds installations, making it particularly dangerous for platforms hosting classified advertisements where users may be browsing with active sessions. This weakness could compromise user privacy and potentially lead to unauthorized access to classified listings or user accounts.
Mitigation strategies for this vulnerability require immediate application updates to version 2.1.3 or later, which includes proper input validation and output sanitization measures. Organizations should implement comprehensive input filtering mechanisms that escape or remove potentially dangerous characters from PATH_INFO parameters before processing. Security headers such as Content Security Policy should be implemented to provide additional defense-in-depth against XSS attacks. The vulnerability demonstrates the importance of proper error handling and input validation practices, aligning with ATT&CK technique T1211 which covers exploitation of input validation weaknesses. Regular security assessments and vulnerability scanning should be conducted to identify similar flaws in web applications, particularly in error handling components where user input is processed without adequate sanitization.