CVE-2024-10764
📋 TL;DR
This critical vulnerability in Codezips Online Institute Management System 1.0 allows remote attackers to upload arbitrary files via the /pages/save_user.php endpoint by manipulating the 'image' parameter. This affects all installations of version 1.0 that have the vulnerable component exposed. Attackers can potentially upload malicious files to execute code or compromise the system.
💻 Affected Systems
- Codezips Online Institute Management System
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise, data theft, and lateral movement within the network.
Likely Case
File upload leading to web shell deployment, defacement, or malware distribution from the compromised server.
If Mitigated
Upload attempts are blocked or quarantined, with alerts generated for security monitoring.
🎯 Exploit Status
Exploit details are publicly available on GitHub. The vulnerability requires minimal technical skill to exploit.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None known
Restart Required: No
Instructions:
No official patch available. Consider workarounds or migrating to a different system.
🔧 Temporary Workarounds
Block access to vulnerable endpoint
allRestrict access to /pages/save_user.php using web server configuration or WAF rules.
# Apache: <Location /pages/save_user.php> Require all denied </Location>
# Nginx: location /pages/save_user.php { deny all; }
Implement file upload validation
allAdd server-side validation for file uploads including file type checking, size limits, and content scanning.
🧯 If You Can't Patch
- Implement strict network segmentation to isolate the vulnerable system
- Deploy a web application firewall (WAF) with file upload protection rules
🔍 How to Verify
Check if Vulnerable:
Attempt to upload a non-image file via POST to /pages/save_user.php with 'image' parameter. If successful, system is vulnerable.Check Version:
Check system documentation or admin panel for version informationVerify Fix Applied:
Test the same upload attempt after applying workarounds - should be blocked or fail.📡 Detection & Monitoring
Log Indicators:
- Multiple POST requests to /pages/save_user.php
- Uploads of unusual file types (e.g., .php, .exe)
- Large file uploads to the vulnerable endpoint
Network Indicators:
- POST requests to /pages/save_user.php with file uploads
- Subsequent connections to uploaded malicious files
SIEM Query:
source="web_server" AND uri="/pages/save_user.php" AND method="POST" AND (file_extension="php" OR file_extension="exe" OR file_size>10000000)