CVE-2024-32167
📋 TL;DR
CVE-2024-32167 is an arbitrary file deletion vulnerability in Sourcecodester Online Medicine Ordering System 1.0 that allows attackers to delete any file on the server through the picture deletion function. This affects all installations of version 1.0 of this PHP-based web application. Attackers can potentially delete critical system files, configuration files, or application data.
💻 Affected Systems
- Sourcecodester Online Medicine Ordering System
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise through deletion of critical system files (like /etc/passwd on Linux or SAM database on Windows), leading to system crashes, data loss, or privilege escalation by deleting authentication files.
Likely Case
Application disruption through deletion of configuration files, database files, or other application components, causing service downtime and potential data loss.
If Mitigated
Limited impact if proper file permissions restrict deletion to non-critical directories and files are regularly backed up.
🎯 Exploit Status
The GitHub reference shows exploitation details. This is a simple file path manipulation vulnerability requiring minimal technical skill to exploit.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None found
Restart Required: No
Instructions:
No official patch available. Consider: 1. Remove the vulnerable application entirely. 2. Replace with alternative software. 3. If continuing use, implement strict input validation and file permission restrictions.
🔧 Temporary Workarounds
Restrict file deletion permissions
linuxSet strict file permissions to prevent the web server user from deleting critical files
chmod 644 /path/to/critical/files
chown root:root /path/to/critical/files
Implement web application firewall rules
allBlock requests containing file path traversal patterns
# Example mod_security rule: SecRule ARGS "\.\./" "id:1001,phase:2,deny,msg:'Path Traversal Attempt'
🧯 If You Can't Patch
- Isolate the application in a restricted network segment with no access to critical systems
- Implement comprehensive file integrity monitoring and regular backups to detect and recover from file deletions
🔍 How to Verify
Check if Vulnerable:
Check if you have Sourcecodester Online Medicine Ordering System version 1.0 installed. Review the application's picture deletion functionality for lack of input validation on file paths.Check Version:
Check the application's version.php file or documentation for version informationVerify Fix Applied:
Test the picture deletion function with path traversal payloads (like ../../../etc/passwd) to ensure they are rejected.📡 Detection & Monitoring
Log Indicators:
- Web server logs showing requests to picture deletion endpoints with suspicious file paths
- System logs showing unexpected file deletions by the web server user
Network Indicators:
- HTTP POST requests to picture deletion endpoints containing path traversal sequences (../)
SIEM Query:
source="web_server" AND (uri="*/delete_picture*" OR uri="*/settings*" OR uri="*/backend*") AND (request_body="../" OR request_body="..\\")