CVE-2024-7500
📋 TL;DR
CVE-2024-7500 is a critical unrestricted file upload vulnerability in itsourcecode Airline Reservation System 1.0. Attackers can remotely upload malicious files via the img parameter in the save_settings function, potentially leading to server compromise. This affects all deployments of version 1.0 with the vulnerable admin/admin_class.php file.
💻 Affected Systems
- itsourcecode Airline Reservation System
📦 What is this software?
Airline Reservation System by Angeljudesuarez
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system takeover, data theft, and lateral movement within the network.
Likely Case
Webshell deployment allowing persistent backdoor access, file system manipulation, and potential data exfiltration.
If Mitigated
File upload attempts blocked or sanitized, preventing malicious file execution while maintaining normal functionality.
🎯 Exploit Status
Exploit requires admin access but is trivial to execute once authenticated. Public exploit code exists in GitHub repositories.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None known
Restart Required: No
Instructions:
No official patch available. Consider workarounds or migrating to a supported system.
🔧 Temporary Workarounds
File Upload Restriction
allImplement server-side validation to restrict uploaded file types to safe extensions (e.g., .jpg, .png) and verify file content.
Admin Panel Access Control
allRestrict admin panel access to specific IP addresses and enforce strong authentication.
🧯 If You Can't Patch
- Disable the vulnerable save_settings function or remove admin/admin_class.php if not essential.
- Implement a web application firewall (WAF) with file upload protection rules.
🔍 How to Verify
Check if Vulnerable:
Check if admin/admin_class.php exists and contains the save_settings function with img parameter handling without proper file validation.Check Version:
Check system documentation or configuration files for version 1.0 indication.Verify Fix Applied:
Test file upload functionality with malicious files to ensure they are rejected or sanitized.📡 Detection & Monitoring
Log Indicators:
- Unusual file uploads to admin panel, especially non-image files with executable extensions.
- Multiple failed upload attempts with suspicious filenames.
Network Indicators:
- HTTP POST requests to admin/admin_class.php with file uploads containing unusual file types.
SIEM Query:
source="web_logs" AND uri="/admin/admin_class.php" AND method="POST" AND file_extension IN ("php", "exe", "sh")