CVE-2024-57668
Published: 06 February 2025
Description
Adversaries may backdoor web servers with web shells to establish persistent access to systems.
Security Summary
CVE-2024-57668 is an arbitrary file upload vulnerability (CWE-434) affecting Code-projects Shopping Portal version 1.0, specifically in the insert-product.php page. This flaw allows unrestricted upload of files with dangerous types, earning a high CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating significant potential for remote exploitation with low complexity and low privileges required.
An attacker with low privileges, such as a registered user on the shopping portal, can exploit this vulnerability over the network without user interaction. By submitting malicious files through the insert-product.php endpoint, they can achieve high impacts on confidentiality, integrity, and availability, potentially leading to server-side code execution, data compromise, or system disruption depending on the uploaded file type and server configuration.
Advisories and details are documented in references including the project's source code page at https://code-projects.org/shopping-portal-using-php-source-code/ and a vulnerability report at https://github.com/passevery/vul/issues/1. No specific patches or mitigations are detailed in the provided information.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise Techniques
Why these techniques?
Arbitrary file upload in public-facing PHP web application (insert-product.php) enables exploitation of public-facing application (T1190) and uploading/executing web shells or Trojans (T1100) for remote code execution and server compromise.