CVE-2023-24202
📋 TL;DR
Raffle Draw System v1.0 contains a local file inclusion vulnerability in the page parameter of index.php. This allows attackers to read arbitrary files from the server, potentially exposing sensitive data. Anyone using this specific version of the software is affected.
💻 Affected Systems
- Raffle Draw System
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Full server compromise through reading sensitive files like /etc/passwd, database credentials, or session files, potentially leading to remote code execution.
Likely Case
Unauthorized access to sensitive configuration files, source code, or user data stored on the server.
If Mitigated
Limited impact with proper file permissions and input validation preventing directory traversal.
🎯 Exploit Status
Simple HTTP request manipulation required, no authentication needed.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None available
Restart Required: No
Instructions:
No official patch exists. Remove or replace the vulnerable software.
🔧 Temporary Workarounds
Input Validation Filter
allAdd input validation to restrict page parameter to allowed values only
Modify index.php to validate page parameter against whitelist
Web Application Firewall Rule
allBlock requests with directory traversal patterns in page parameter
Add WAF rule to detect ../ patterns in URL parameters
🧯 If You Can't Patch
- Remove Raffle Draw System v1.0 from production immediately
- Isolate affected systems from network access until replacement
🔍 How to Verify
Check if Vulnerable:
Test by accessing index.php?page=../../../../etc/passwd and checking for file contents in responseCheck Version:
Check software version in admin panel or readme filesVerify Fix Applied:
Attempt same LFI test after fixes - should return error or default page📡 Detection & Monitoring
Log Indicators:
- HTTP requests with ../ patterns in page parameter
- Unusual file access patterns from web logs
Network Indicators:
- HTTP GET requests with directory traversal sequences
SIEM Query:
web.url:*../* AND web.param.page:*../*🔗 References
- https://github.com/xiumulty/CVE/blob/main/Raffle%20draw%20system%20v1.0/lfi%20in%20index.php.md
- https://www.sourcecodester.com/php/15951/raffle-draw-system-using-php-and-javascript-free-source-code.html
- https://github.com/xiumulty/CVE/blob/main/Raffle%20draw%20system%20v1.0/lfi%20in%20index.php.md
- https://www.sourcecodester.com/php/15951/raffle-draw-system-using-php-and-javascript-free-source-code.html
