CVE-2024-57428

Summary

CVE-2024-57428 is a stored cross-site scripting (XSS) vulnerability affecting the PHPJabbers Cinema Booking System v2.0. The issue arises due to insufficient input validation in file upload fields, namely event_img and seat-maps, and seat number configurations (number[new_X] in pjActionCreate). Malicious actors can exploit this vulnerability to inject persistent JavaScript code. Consequences of such an attack include phishing, malware injection, and session hijacking. This weakness poses a significant risk to users interacting with the Cinema Booking System and emphasizes the importance of proper input validation measures.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.