CVE-2024-24494
Published: 08 February 2024
Summary
CVE-2024-24494 is a medium-severity Cross-site Scripting (CWE-79) vulnerability in Remyandrade Daily Habit Tracker. Its CVSS base score is 6.1 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 3.0% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
Daily Habit Tracker version 1.0 is affected by a stored cross-site scripting vulnerability, tracked as CVE-2024-24494 with CWE-79. The flaw resides in the add-tracker.php and update-tracker.php components, where the day, exercise, pray, read_book, vitamins, laundry, alcohol, and meat parameters are not properly sanitized before being processed or stored.
An unauthenticated remote attacker can supply malicious payloads through these parameters to execute arbitrary JavaScript in the browsers of other users who view the affected tracker entries. Successful exploitation yields session hijacking, data theft, or other client-side actions within the application's security context, consistent with the CVSS 6.1 rating reflecting network attack vector and required user interaction.
The two referenced GitHub reports document the stored XSS vectors but provide no details on vendor patches, workarounds, or mitigation guidance. The associated EPSS score has remained flat at 0.3358 with no post-disclosure increase.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-21913
Vulnerability details
Cross Site Scripting vulnerability in Daily Habit Tracker v.1.0 allows a remote attacker to execute arbitrary code via the day, exercise, pray, read_book, vitamins, laundry, alcohol and meat parameters in the add-tracker.php and update-tracker.php components.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The stored XSS vulnerability (CVE-2024-24494) in the public-facing web application (Daily Habit Tracker) enables remote attackers to exploit the application by injecting malicious scripts via input parameters, leading to arbitrary JavaScript execution in victims' browsers.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Penetration testing submits XSS payloads to web applications, detecting cross-site scripting flaws for subsequent remediation.
Validates web inputs to reject script-related content that could produce XSS.
Output validation against expected content can reject or sanitize script content in generated web pages, reducing XSS exploitability.