CVE-2024-2066 in Computer Inventory System
Summary
by MITRE • 03/01/2024
A vulnerability was found in SourceCodester Computer Inventory System 1.0. It has been classified as problematic. This affects an unknown part of the file /endpoint/add-computer.php. The manipulation of the argument model leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-255381 was assigned to this vulnerability.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 04/18/2025
The vulnerability identified as CVE-2024-2066 represents a cross-site scripting vulnerability within the SourceCodester Computer Inventory System version 1.0, specifically affecting the /endpoint/add-computer.php file. This classification as a problematic vulnerability indicates a significant security risk that could be exploited by malicious actors to compromise user sessions and potentially gain unauthorized access to sensitive system information. The vulnerability resides in the handling of the model parameter, which serves as the attack vector for executing malicious scripts within the context of the affected application.
The technical flaw manifests through improper input validation and sanitization of the model argument in the add-computer.php endpoint. When user-supplied data is directly incorporated into web page content without adequate sanitization or encoding, it creates an opportunity for attackers to inject malicious JavaScript code. This weakness allows an attacker to craft a payload that, when executed, can perform actions on behalf of authenticated users or steal session cookies and other sensitive information. The vulnerability's classification as remotely exploitable means that no local access or user interaction is required for the attack to succeed, making it particularly dangerous in web-facing applications.
The operational impact of this vulnerability extends beyond simple script execution, as it can enable more sophisticated attacks within the context of the computer inventory system. An attacker could potentially steal user credentials, manipulate inventory data, or redirect users to malicious websites. The fact that the exploit has been publicly disclosed and is actively being used increases the risk level significantly, as it removes the element of surprise that attackers typically rely on for successful exploitation. This vulnerability could compromise the integrity and confidentiality of the entire computer inventory management system, potentially affecting thousands of devices and their associated data.
Mitigation strategies should focus on implementing proper input validation and output encoding mechanisms to prevent malicious scripts from being executed. The system should sanitize all user inputs, particularly those used in dynamic content generation, and employ Content Security Policy headers to restrict script execution. Additionally, the application should be updated to the latest version if available, and developers should implement proper parameter validation to ensure that the model argument cannot contain malicious payloads. This vulnerability aligns with CWE-79 which describes cross-site scripting flaws, and follows attack patterns documented in the ATT&CK framework under web application attacks, specifically targeting input validation weaknesses in web applications.