CVE-2024-7917
📋 TL;DR
This vulnerability in DouPHP 1.7 allows attackers to upload arbitrary files via the favicon handler in the admin system.php file. Attackers can exploit this remotely to potentially execute malicious code on affected systems. Organizations using DouPHP 1.7 Release 20220822 are affected.
💻 Affected Systems
- DouPHP
📦 What is this software?
Douphp by Douco
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise, data theft, or ransomware deployment
Likely Case
Webshell upload allowing persistent backdoor access and further system exploitation
If Mitigated
File upload blocked or restricted to safe file types only
🎯 Exploit Status
Exploit details are publicly available and the vulnerability is straightforward to exploit
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: Not available
Restart Required: No
Instructions:
No official patch available. Consider upgrading to a newer version if available or implementing workarounds.
🔧 Temporary Workarounds
Restrict file uploads in admin/system.php
allModify the favicon handler to restrict file uploads to specific safe file types
Edit /admin/system.php to add file type validation for site_favicon uploads
Implement file upload restrictions via web server
linuxConfigure web server to block or restrict uploads to the vulnerable endpoint
Add location block in nginx: location ~ ^/admin/system\.php$ { deny all; }
Add Directory block in Apache: <Directory /admin> <Files system.php> Order Deny,Allow Deny from all </Files> </Directory>
🧯 If You Can't Patch
- Implement strict file upload validation and sanitization
- Restrict admin panel access to trusted IP addresses only
🔍 How to Verify
Check if Vulnerable:
Check if running DouPHP 1.7 Release 20220822 and examine /admin/system.php for unrestricted file upload in favicon handlerCheck Version:
Check DouPHP version in configuration files or admin panelVerify Fix Applied:
Test file upload functionality with malicious files to ensure they are blocked📡 Detection & Monitoring
Log Indicators:
- Unusual file uploads to /admin/system.php
- Multiple failed upload attempts
- Uploads of non-image files to favicon endpoint
Network Indicators:
- POST requests to /admin/system.php with file uploads
- Unusual outbound connections from web server
SIEM Query:
source="web_logs" AND uri="/admin/system.php" AND method="POST" AND (file_upload="true" OR content_type="multipart/form-data")