CVE-2024-1008: Employee Management System RCE Vulnerability

CVE-2024-1008 Overview

CVE-2024-1008 is an unrestricted file upload vulnerability in SourceCodester Employee Management System 1.0. The flaw resides in the edit-photo.php script within the Profile Page component. Attackers with valid authentication can upload arbitrary files, including server-executable scripts, over the network. Public disclosure of the exploit technique increases the risk of opportunistic attacks. The issue is tracked in VulDB as VDB-252277 and maps to CWE-434: Unrestricted Upload of File with Dangerous Type.

Critical Impact
Authenticated attackers can upload malicious files through the profile photo function and achieve remote code execution on the hosting web server.

Affected Products

SourceCodester Employee Management System 1.0 (razormist)
edit-photo.php component within the Profile Page module
Deployments exposing the application over the network

Discovery Timeline

2024-01-29 - CVE-2024-1008 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-1008

Vulnerability Analysis

The vulnerability is an unrestricted file upload flaw in the profile photo handler. The edit-photo.php endpoint accepts user-supplied files without validating file type, extension, or MIME content. Attackers can substitute a PHP script for the expected image file and place it in a web-accessible directory. Once uploaded, the attacker requests the file directly to trigger server-side execution.

The EPSS score of 0.751% indicates limited but non-trivial exploitation probability. Public disclosure of the technique and the low complexity of the attack make this an accessible target for automated scanners.

Root Cause

The root cause is missing server-side validation of uploaded files in edit-photo.php. The application trusts client-provided file metadata and does not enforce an allowlist of safe image extensions. It also fails to rewrite filenames or store uploads outside the webroot, allowing direct execution of uploaded PHP.

Attack Vector

An authenticated user with access to the Profile Page submits a crafted multipart form request to edit-photo.php. The request contains a PHP payload disguised with an image content type or a double extension such as shell.php.jpg. After upload, the attacker browses to the stored path and the web server executes the payload with the privileges of the PHP process.

No verified public exploit code is referenced in the NVD entry. Technical details are described in the VulDB entry for VDB-252277.

Detection Methods for CVE-2024-1008

Indicators of Compromise

New files with .php, .phtml, or double-extension names inside profile photo upload directories
Web server access logs showing POST requests to edit-photo.php followed by GET requests to newly created files
Outbound connections from the web server process to unfamiliar external hosts after profile edits
Unexpected shell processes spawned by the PHP-FPM or Apache worker process

Detection Strategies

Monitor the upload directory for file writes where the extension or magic bytes do not match a supported image format
Alert on web requests to edit-photo.php that carry non-image Content-Type values or oversized payloads
Correlate authenticated session activity with subsequent file creation events on the web server host

Monitoring Recommendations

Enable verbose access and error logging for the Employee Management System web root
Ship web server, PHP, and host process telemetry to a central SIEM for correlation
Baseline normal profile update volume so anomalous upload bursts are visible

How to Mitigate CVE-2024-1008

Immediate Actions Required

Restrict network access to the Employee Management System until a fix is applied
Disable the profile photo upload feature or block requests to edit-photo.php at the reverse proxy
Audit the upload directory for unauthorized files and remove any web shells
Rotate credentials for all accounts that had access to the Profile Page

Patch Information

No vendor patch is listed in the NVD entry or referenced VulDB records for SourceCodester Employee Management System 1.0. Operators should treat the deployment as end-of-support and migrate to a maintained alternative or apply the workarounds below.

Workarounds

Enforce a server-side allowlist that accepts only image/jpeg, image/png, and image/gif content, validated by magic bytes
Rename uploaded files to random identifiers and strip original extensions before storage
Store uploads outside the webroot and serve them through a script that sets a static Content-Type
Configure the web server to deny script execution in the uploads directory

bash

# Apache: prevent script execution in the profile photo upload directory
<Directory "/var/www/ems/uploads">
    php_admin_flag engine off
    RemoveHandler .php .phtml .phar
    RemoveType .php .phtml .phar
    <FilesMatch "\.(php|phtml|phar)$">
        Require all denied
    </FilesMatch>
</Directory>