CVE-2024-32256
📋 TL;DR
Phpgurukul Tourism Management System v2.0 contains an unrestricted file upload vulnerability in the admin panel's change-image.php endpoint. Attackers can upload malicious files (like PHP webshells) when updating packages, potentially leading to remote code execution. This affects all installations using the vulnerable version.
💻 Affected Systems
- Phpgurukul Tourism Management System
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise via remote code execution, allowing attackers to execute arbitrary commands, steal data, install malware, or pivot to other systems.
Likely Case
Webshell deployment leading to data theft, defacement, or use as a foothold for further attacks.
If Mitigated
File upload attempts are blocked or quarantined, preventing malicious file execution.
🎯 Exploit Status
Exploitation requires admin credentials but is straightforward once authenticated. Multiple public PoCs demonstrate webshell upload.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None known
Restart Required: No
Instructions:
No official patch available. Consider workarounds or migrating to alternative software.
🔧 Temporary Workarounds
Implement File Upload Restrictions
allAdd server-side validation to restrict uploaded files to safe extensions (jpg, png, gif) and verify MIME types.
Modify /tms/admin/change-image.php to include file type validation
Restrict Admin Panel Access
allLimit access to the /tms/admin/ directory using IP whitelisting or VPN requirements.
Add .htaccess rules or web server configuration to restrict IPs
🧯 If You Can't Patch
- Disable the change-image.php endpoint or rename it to prevent access
- Implement a Web Application Firewall (WAF) with file upload protection rules
🔍 How to Verify
Check if Vulnerable:
Attempt to upload a file with a dangerous extension (like .php) to /tms/admin/change-image.php while authenticated as admin. If it succeeds without validation, the system is vulnerable.Check Version:
Check system documentation or configuration files for version informationVerify Fix Applied:
Test file upload with restricted extensions; dangerous files should be rejected with an error message.📡 Detection & Monitoring
Log Indicators:
- Unusual file uploads to /tms/admin/change-image.php, especially with non-image extensions
- HTTP POST requests with file uploads to the vulnerable endpoint
Network Indicators:
- File upload traffic to the admin panel with suspicious file types
SIEM Query:
source="web_logs" AND uri="/tms/admin/change-image.php" AND method="POST" AND file_extension IN ("php", "exe", "sh", "jsp")