CVE-2024-10161
📋 TL;DR
This critical vulnerability in PHPGurukul Boat Booking System 1.0 allows remote attackers to upload arbitrary files via the change-image.php component, potentially leading to remote code execution. It affects all installations of version 1.0 that have the vulnerable component accessible. Attackers can exploit this without authentication to compromise the system.
💻 Affected Systems
- PHPGurukul Boat Booking System
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise, data theft, and potential lateral movement within the network.
Likely Case
Webshell deployment allowing persistent access, data exfiltration, and further exploitation of the server.
If Mitigated
File upload attempts blocked or logged, preventing successful exploitation while maintaining system integrity.
🎯 Exploit Status
Public exploit details are available on GitHub, making exploitation straightforward for attackers with basic skills.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Not available
Vendor Advisory: Not available
Restart Required: No
Instructions:
No official patch is available. Consider the following: 1. Remove or disable the vulnerable change-image.php file. 2. Implement input validation and file type restrictions. 3. Consider migrating to a supported alternative system.
🔧 Temporary Workarounds
Disable vulnerable component
linuxRemove or restrict access to the change-image.php file to prevent exploitation.
mv /path/to/change-image.php /path/to/change-image.php.disabled
chmod 000 /path/to/change-image.php
Implement file upload restrictions
allAdd server-side validation to restrict file uploads to specific extensions and sizes.
🧯 If You Can't Patch
- Implement strict web application firewall (WAF) rules to block file upload attempts to change-image.php
- Isolate the system in a segmented network zone with strict outbound traffic controls
🔍 How to Verify
Check if Vulnerable:
Check if change-image.php exists in the Boat Booking System installation directory and test if it accepts arbitrary file uploads without proper validation.Check Version:
Check the system documentation or configuration files for version information, as there is no standard version command.Verify Fix Applied:
Attempt to upload a malicious file to change-image.php; successful blocking indicates the fix is working.📡 Detection & Monitoring
Log Indicators:
- Unusual POST requests to change-image.php
- File upload attempts with suspicious extensions (.php, .exe, .jsp)
- Large file uploads to the boat booking system
Network Indicators:
- HTTP traffic to change-image.php with file upload content
- Outbound connections from the server following file uploads
SIEM Query:
source="web_server" AND uri="*change-image.php*" AND method="POST" AND (content_type="multipart/form-data" OR user_agent="*curl*" OR user_agent="*wget*")