CVE-2024-9815
📋 TL;DR
This vulnerability allows remote attackers to upload arbitrary files to the Tourist Management System 1.0 through the /admin/create-package.php endpoint. Attackers can exploit this to upload malicious files like webshells, potentially leading to system compromise. Organizations using Codezips Tourist Management System 1.0 are affected.
💻 Affected Systems
- Codezips Tourist Management System
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete system takeover through webshell upload leading to remote code execution, data theft, and lateral movement within the network.
Likely Case
Attackers upload webshells to gain persistent access, deface websites, or steal sensitive tourist/customer data.
If Mitigated
File uploads are blocked or properly validated, limiting impact to denial of service if upload attempts fail.
🎯 Exploit Status
Exploit requires admin access to reach /admin/create-package.php endpoint.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None found
Restart Required: No
Instructions:
No official patch available. Consider workarounds or migrating to alternative software.
🔧 Temporary Workarounds
Restrict File Upload Types
allImplement server-side validation to only allow specific image file types (jpg, png, gif) and check file signatures.
Web Application Firewall Rules
allConfigure WAF to block requests to /admin/create-package.php with suspicious file uploads.
🧯 If You Can't Patch
- Restrict network access to the admin interface using IP whitelisting or VPN.
- Implement file integrity monitoring on the upload directory to detect unauthorized file changes.
🔍 How to Verify
Check if Vulnerable:
Attempt to upload a non-image file (e.g., .php, .exe) to /admin/create-package.php and check if it's accepted.Check Version:
Check system documentation or admin panel for version information.Verify Fix Applied:
Test that only allowed file types are accepted and malicious files are rejected with proper validation.📡 Detection & Monitoring
Log Indicators:
- Unusual file uploads to /admin/create-package.php
- Uploads of non-image file types
- Multiple failed upload attempts
Network Indicators:
- POST requests to /admin/create-package.php with executable file extensions
SIEM Query:
source="web_logs" AND uri="/admin/create-package.php" AND (file_extension="php" OR file_extension="exe" OR file_extension="jsp")