CVE-2024-3437
📋 TL;DR
This critical vulnerability in SourceCodester Prison Management System 1.0 allows remote attackers to upload arbitrary files via the avatar handler in /Admin/add-admin.php. This can lead to remote code execution, compromising the entire system. Organizations using this specific software version are affected.
💻 Affected Systems
- SourceCodester Prison Management System
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise with remote code execution, data theft, privilege escalation, and potential lateral movement within the network.
Likely Case
Webshell deployment leading to unauthorized access, data exfiltration, and system manipulation.
If Mitigated
Limited impact with proper file upload restrictions and web application firewalls blocking malicious uploads.
🎯 Exploit Status
Public exploit code available on GitHub. Attack requires no authentication and is straightforward to execute.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None found
Restart Required: No
Instructions:
No official patch available. Consider workarounds or replacing the software.
🔧 Temporary Workarounds
Restrict File Uploads
allImplement strict file upload validation on the web server to only allow specific file types and sizes.
# Configure web server (e.g., Apache/Nginx) to block uploads to /Admin/add-admin.php
# Implement PHP file upload restrictions in php.ini
Web Application Firewall Rules
allDeploy WAF rules to block requests to the vulnerable endpoint or malicious file upload patterns.
# Example ModSecurity rule: SecRule REQUEST_URI "@streq /Admin/add-admin.php" "id:1001,deny,status:403"
🧯 If You Can't Patch
- Isolate the system from the internet and restrict network access to necessary internal users only.
- Implement strict monitoring and alerting for file upload activities to the vulnerable endpoint.
🔍 How to Verify
Check if Vulnerable:
Check if Prison Management System version 1.0 is installed and accessible. Attempt to upload a file to /Admin/add-admin.php with avatar parameter.Check Version:
# Check application version in web interface or configuration filesVerify Fix Applied:
Verify that file uploads to /Admin/add-admin.php are blocked or properly validated. Test with malicious file upload attempts.📡 Detection & Monitoring
Log Indicators:
- HTTP POST requests to /Admin/add-admin.php with file uploads
- Unusual file creation in web directories
- Execution of unexpected processes from web user
Network Indicators:
- Outbound connections from web server to unknown IPs
- Unusual traffic patterns from the application server
SIEM Query:
source="web_server" AND uri="/Admin/add-admin.php" AND method="POST" AND file_upload=true🔗 References
- https://github.com/fubxx/CVE/blob/main/PrisonManagementSystemRCE2.md
- https://vuldb.com/?ctiid.259631
- https://vuldb.com/?id.259631
- https://vuldb.com/?submit.311920
- https://github.com/fubxx/CVE/blob/main/PrisonManagementSystemRCE2.md
- https://vuldb.com/?ctiid.259631
- https://vuldb.com/?id.259631
- https://vuldb.com/?submit.311920
