CVE-2024-6373
📋 TL;DR
This critical vulnerability allows remote attackers to upload arbitrary files to the Online Food Ordering System via the /addproduct.php endpoint. Attackers can potentially execute malicious code on the server, compromising the entire system. All users running itsourcecode Online Food Ordering System version 1.0 or earlier are affected.
💻 Affected Systems
- itsourcecode Online Food Ordering System
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise leading to data theft, ransomware deployment, or complete server takeover
Likely Case
Webshell installation allowing persistent backdoor access and further exploitation
If Mitigated
Limited impact with proper file upload restrictions and web application firewalls
🎯 Exploit Status
Exploit details are publicly available on GitHub; simple file upload bypass techniques can be used
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None available
Restart Required: No
Instructions:
No official patch available. Consider migrating to alternative software or implementing strict file upload controls.
🔧 Temporary Workarounds
Restrict file uploads
allImplement strict file type validation and size limits for uploads
Disable /addproduct.php
linuxTemporarily disable or rename the vulnerable file
mv /path/to/addproduct.php /path/to/addproduct.php.disabled
🧯 If You Can't Patch
- Implement web application firewall (WAF) rules to block malicious file uploads
- Isolate the system in a DMZ with strict network segmentation
🔍 How to Verify
Check if Vulnerable:
Check if /addproduct.php exists and accepts file uploads without proper validationCheck Version:
Check software version in admin panel or configuration filesVerify Fix Applied:
Test file upload functionality with malicious file types; they should be rejected📡 Detection & Monitoring
Log Indicators:
- Unusual file uploads to /addproduct.php
- Execution of unexpected PHP files in upload directories
Network Indicators:
- POST requests to /addproduct.php with file uploads
- Unusual outbound connections from web server
SIEM Query:
source="web_server" AND (uri="/addproduct.php" AND method="POST") AND (file_upload="true" OR content_type="multipart/form-data")