CVE-2024-5047
📋 TL;DR
This critical vulnerability in SourceCodester Student Management System 1.0 allows attackers to upload arbitrary files via the photo parameter in /student/controller.php. This can lead to remote code execution or system compromise. All users running the affected version are vulnerable.
💻 Affected Systems
- SourceCodester Student Management System
📦 What is this software?
Student Management System by Kabir M Alhasan
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system takeover, data theft, ransomware deployment, or creation of persistent backdoors.
Likely Case
Webshell upload allowing unauthorized access, data exfiltration, or use as pivot point for internal network attacks.
If Mitigated
File uploads blocked or properly validated, limiting impact to denial of service or failed attack attempts.
🎯 Exploit Status
Public exploit available on GitHub; simple HTTP POST with malicious file.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None found
Restart Required: No
Instructions:
No official patch available. Consider replacing with alternative software or implementing workarounds.
🔧 Temporary Workarounds
Web Application Firewall Rule
allBlock file uploads to /student/controller.php or restrict allowed file types
WAF specific - configure to block .php, .jsp, .asp, .exe uploads via photo parameter
File Upload Validation
allImplement server-side file type validation and rename uploaded files
Modify controller.php to validate file extensions and MIME types
🧯 If You Can't Patch
- Remove or restrict access to /student/controller.php endpoint
- Implement network segmentation to isolate the vulnerable system
🔍 How to Verify
Check if Vulnerable:
Attempt to upload a test file (e.g., test.php) via POST to /student/controller.php with photo parameterCheck Version:
Check application version in admin panel or source code headersVerify Fix Applied:
Verify file upload validation rejects malicious file types and renames uploaded files📡 Detection & Monitoring
Log Indicators:
- Unusual file uploads to /student/controller.php
- POST requests with executable file extensions in photo parameter
Network Indicators:
- HTTP POST to /student/controller.php with file uploads
- Subsequent connections to uploaded malicious files
SIEM Query:
source="web_logs" AND uri="/student/controller.php" AND method="POST" AND (file_extension="php" OR file_extension="jsp" OR file_extension="asp")🔗 References
- https://github.com/I-Schnee-I/cev/blob/main/SourceCodester%20Student%20Management%20System%201.0%20controller.php%20Unrestricted%20Upload.md
- https://vuldb.com/?ctiid.264744
- https://vuldb.com/?id.264744
- https://vuldb.com/?submit.335633
- https://github.com/I-Schnee-I/cev/blob/main/SourceCodester%20Student%20Management%20System%201.0%20controller.php%20Unrestricted%20Upload.md
- https://vuldb.com/?ctiid.264744
- https://vuldb.com/?id.264744
- https://vuldb.com/?submit.335633
