CVE-2024-5745
📋 TL;DR
CVE-2024-5745 is a critical unrestricted file upload vulnerability in itsourcecode Bakery Online Ordering System 1.0. Attackers can remotely upload malicious files via the /admin/modules/product/controller.php?action=add endpoint by manipulating the image parameter. This affects all installations of Bakery Online Ordering System 1.0.
💻 Affected Systems
- itsourcecode Bakery Online Ordering System
📦 What is this software?
Bakery Online Ordering System by Bakery Online Ordering System Project
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise, data theft, and potential ransomware deployment.
Likely Case
Webshell upload allowing persistent backdoor access, data exfiltration, and lateral movement within the network.
If Mitigated
File upload blocked or sanitized, preventing malicious file execution while maintaining legitimate functionality.
🎯 Exploit Status
Exploit code is publicly available on GitHub. Attack requires only web access to vulnerable endpoint.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None available
Restart Required: No
Instructions:
No official patch available. Consider workarounds or migrating to alternative software.
🔧 Temporary Workarounds
Web Application Firewall Rule
allBlock requests to /admin/modules/product/controller.php?action=add containing file uploads
WAF-specific configuration required
File Upload Restriction
linuxConfigure web server to block file uploads to vulnerable endpoint
# Apache: <Location "/admin/modules/product/controller.php">
# SetEnvIf Request_URI ".*action=add.*" block_upload
# Deny from env=block_upload
# </Location>
# Nginx: location ~* /admin/modules/product/controller\.php\?action=add {
# deny all;
# }
🧯 If You Can't Patch
- Isolate the system from internet access and restrict to internal network only
- Implement strict file upload validation: allow only specific image extensions, verify file signatures, store uploads outside web root
🔍 How to Verify
Check if Vulnerable:
Attempt to upload a test file (e.g., test.txt) to /admin/modules/product/controller.php?action=add with image parameter. If upload succeeds without validation, system is vulnerable.Check Version:
Check application version in admin panel or readme files. Default vulnerable version is 1.0.Verify Fix Applied:
Attempt same upload test. System should reject the upload or properly validate/sanitize the file.📡 Detection & Monitoring
Log Indicators:
- HTTP POST requests to /admin/modules/product/controller.php with action=add parameter
- File uploads with unusual extensions (.php, .jsp, .asp) to upload directories
- Large number of failed upload attempts
Network Indicators:
- Unusual traffic to /admin/modules/product/controller.php endpoint
- POST requests with file uploads to vulnerable path
SIEM Query:
source="web_logs" AND (url="/admin/modules/product/controller.php" AND parameters CONTAINS "action=add") AND method="POST"🔗 References
- https://github.com/L1OudFd8cl09/CVE/blob/main/07_06_2024_a.md
- https://vuldb.com/?ctiid.267414
- https://vuldb.com/?id.267414
- https://vuldb.com/?submit.351827
- https://github.com/L1OudFd8cl09/CVE/blob/main/07_06_2024_a.md
- https://vuldb.com/?ctiid.267414
- https://vuldb.com/?id.267414
- https://vuldb.com/?submit.351827
