CVE-2024-6115
📋 TL;DR
This critical vulnerability in Simple Online Hotel Reservation System 1.0 allows remote attackers to upload arbitrary files via the photo parameter in add_room.php. This unrestricted file upload can lead to remote code execution or system compromise. All users running version 1.0 are affected.
💻 Affected Systems
- itsourcecode Simple Online Hotel Reservation System
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system takeover, data theft, and deployment of ransomware or backdoors.
Likely Case
Webshell deployment allowing persistent access, data exfiltration, and lateral movement within the network.
If Mitigated
File uploads blocked or sanitized, preventing malicious file execution while maintaining legitimate functionality.
🎯 Exploit Status
Exploit details are publicly available on GitHub, making this easy to weaponize. No authentication required for exploitation.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None found
Restart Required: No
Instructions:
No official patch available. Consider workarounds or replacing the software.
🔧 Temporary Workarounds
Restrict File Uploads
allImplement strict file type validation and size limits for uploads in add_room.php
Modify add_room.php to validate file extensions (allow only .jpg, .png, .gif)
Implement file size limits (<2MB)
Store uploaded files outside web root
Disable add_room.php
allTemporarily disable the vulnerable endpoint
Rename add_room.php to add_room.php.disabled
Add authentication requirement to access add_room.php
🧯 If You Can't Patch
- Implement web application firewall (WAF) rules to block malicious file uploads
- Isolate the system from internet access and restrict internal network access
🔍 How to Verify
Check if Vulnerable:
Check if add_room.php exists and accepts file uploads without proper validation. Attempt to upload a non-image file.Check Version:
Check software version in admin panel or readme filesVerify Fix Applied:
Test that only allowed file types can be uploaded and uploaded files cannot be executed as code.📡 Detection & Monitoring
Log Indicators:
- Unusual file uploads to add_room.php
- Uploads of non-image file types
- Multiple failed upload attempts
Network Indicators:
- HTTP POST requests to add_room.php with file uploads
- Unusual outbound connections from the server after uploads
SIEM Query:
source="web_server" AND uri="/add_room.php" AND method="POST" AND (file_extension!="jpg" OR file_extension!="png" OR file_extension!="gif")