CVE-2024-13067
📋 TL;DR
CVE-2024-13067 is an improper access control vulnerability in CodeAstro Online Food Ordering System 1.0 that allows unauthorized access to the admin/all_users.php page. This enables attackers to view or potentially modify user data without proper authentication. Organizations using this specific version of the food ordering system are affected.
💻 Affected Systems
- CodeAstro Online Food Ordering System
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers gain full administrative access to the system, allowing them to view, modify, or delete all user data, including personal information and order history.
Likely Case
Unauthorized users access sensitive user information from the admin panel, potentially leading to data exposure and privacy violations.
If Mitigated
Proper access controls prevent unauthorized access, limiting exposure to authenticated administrators only.
🎯 Exploit Status
Public proof-of-concept exists on GitHub. Exploitation requires direct access to the vulnerable endpoint.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://codeastro.com/
Restart Required: No
Instructions:
No official patch available. Check vendor website for updates or consider alternative solutions.
🔧 Temporary Workarounds
Restrict Access to Admin Interface
allImplement IP-based restrictions or authentication requirements for the /admin/ directory
# Example Apache .htaccess for IP restriction
Order Deny,Allow
Deny from all
Allow from 192.168.1.0/24
Remove or Rename Vulnerable File
linuxTemporarily disable the vulnerable component by removing or renaming the all_users.php file
mv /path/to/admin/all_users.php /path/to/admin/all_users.php.disabled
🧯 If You Can't Patch
- Implement web application firewall (WAF) rules to block access to /admin/all_users.php
- Monitor access logs for unauthorized attempts to access admin endpoints
🔍 How to Verify
Check if Vulnerable:
Attempt to access http://[target]/admin/all_users.php without authentication. If accessible, system is vulnerable.Check Version:
Check system documentation or configuration files for version informationVerify Fix Applied:
Verify that accessing /admin/all_users.php without proper authentication returns an access denied error.📡 Detection & Monitoring
Log Indicators:
- HTTP 200 responses to /admin/all_users.php from unauthorized IPs
- Multiple failed authentication attempts followed by successful access to admin endpoints
Network Indicators:
- Unusual traffic patterns to admin interfaces from external IPs
- HTTP requests to /admin/all_users.php without referrer or session cookies
SIEM Query:
source="web_logs" AND (url="/admin/all_users.php" OR url="/admin/*") AND response_code=200 AND NOT user_agent="*bot*"🔗 References
- https://codeastro.com/
- https://github.com/shaturo1337/POCs/blob/main/Broken%20Access%20Control%20in%20Online%20Food%20Ordering%20System.md
- https://vuldb.com/?ctiid.289823
- https://vuldb.com/?id.289823
- https://vuldb.com/?submit.472081
- https://github.com/shaturo1337/POCs/blob/main/Broken%20Access%20Control%20in%20Online%20Food%20Ordering%20System.md
