CVE-2024-6801
📋 TL;DR
This critical vulnerability in SourceCodester Online Student Management System 1.0 allows attackers to upload arbitrary files via the /add-students.php endpoint. This can lead to remote code execution or server compromise. All deployments of this specific software version are affected.
💻 Affected Systems
- SourceCodester Online Student Management System
📦 What is this software?
Online Student Management System by Online Student Management System Project
⚠️ Risk & Real-World Impact
Worst Case
Complete server takeover via webshell upload leading to data theft, ransomware deployment, or use as attack platform
Likely Case
Webshell upload enabling persistent backdoor access, data exfiltration, and lateral movement
If Mitigated
File upload attempts blocked or quarantined with no execution capability
🎯 Exploit Status
Public exploit available on GitHub, trivial to weaponize due to simple file upload bypass
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None available
Restart Required: No
Instructions:
No official patch available. Consider migrating to alternative software or implementing workarounds.
🔧 Temporary Workarounds
Web Application Firewall Rule
allBlock requests to /add-students.php or restrict file uploads to specific extensions
WAF specific - configure rule to block: POST /add-students.php with file upload content
File Upload Restriction
linuxImplement server-side file type validation and store uploaded files outside web root
Modify PHP configuration: file_uploads = Off (if not needed)
Add .htaccess: <Files "add-students.php"> Order Allow,Deny Deny from all </Files>
🧯 If You Can't Patch
- Remove or disable the /add-students.php file entirely
- Implement strict network segmentation and isolate the vulnerable system
🔍 How to Verify
Check if Vulnerable:
Attempt to upload a file with malicious extension (e.g., .php) to /add-students.php endpointCheck Version:
Check software version in admin panel or readme filesVerify Fix Applied:
Test that file uploads are properly validated and malicious files cannot be uploaded/executed📡 Detection & Monitoring
Log Indicators:
- Multiple POST requests to /add-students.php
- File uploads with suspicious extensions (.php, .jsp, .asp)
- Large file uploads to unexpected paths
Network Indicators:
- Unusual outbound connections from web server
- POST requests to /add-students.php from unexpected sources
SIEM Query:
source="web_logs" AND (uri="/add-students.php" OR file_extension IN ("php", "jsp", "asp"))