CVE-2024-10161: Phpgurukul Boat Booking System RCE Flaw

CVE-2024-10161 Overview

CVE-2024-10161 is an unrestricted file upload vulnerability in PHPGurukul Boat Booking System 1.0. The flaw resides in the change-image.php file within the Update Boat Image Page component. Attackers can manipulate the image parameter to upload arbitrary files to the server, bypassing file-type restrictions. The vulnerability is exploitable remotely and requires only low-privilege authentication. Public disclosure of the exploit technique has occurred, increasing the risk of active abuse. The weakness maps to [CWE-434] (Unrestricted Upload of File with Dangerous Type), which frequently leads to remote code execution when uploaded files are served by the PHP interpreter.

Critical Impact
Authenticated attackers can upload malicious PHP files through the boat image update functionality, potentially achieving remote code execution on the hosting web server.

Affected Products

PHPGurukul Boat Booking System 1.0
Deployments using the change-image.php Update Boat Image endpoint
Web servers hosting the vulnerable application with PHP execution enabled in upload directories

Discovery Timeline

2024-10-20 - CVE-2024-10161 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-10161

Vulnerability Analysis

The vulnerability exists in the boat image update workflow of PHPGurukul Boat Booking System 1.0. The change-image.php script accepts an image parameter without validating the file type, extension, or MIME content. An attacker with low-privileged access can submit an HTTP POST request containing a PHP web shell disguised as an image. Once uploaded, the file is placed in a directory accessible over HTTP, where the PHP interpreter will execute it on request. This transforms a file management feature into an arbitrary code execution primitive on the underlying server.

Root Cause

The root cause is missing server-side validation on user-supplied uploads in change-image.php. The application does not enforce an allow-list of safe file extensions, does not verify MIME content against magic bytes, and does not rename or sanitize uploaded filenames. This aligns with [CWE-434] Unrestricted Upload of File with Dangerous Type.

Attack Vector

An authenticated user accesses the Update Boat Image Page and submits a crafted multipart form request. The image parameter carries a PHP payload with a double extension such as shell.php.jpg or a bare .php file. The server stores the file in a web-accessible directory. The attacker then requests the uploaded file directly, triggering PHP execution. Refer to the GitHub RCE Vulnerability Report for the detailed exploitation walkthrough.

Detection Methods for CVE-2024-10161

Indicators of Compromise

HTTP POST requests to change-image.php containing multipart data with non-image content types or PHP payload signatures such as <?php.
New files with executable extensions (.php, .phtml, .phar) present in image or upload directories under the Boat Booking System webroot.
Outbound network connections from the web server process (php-fpm, apache, nginx) to unfamiliar external hosts following upload activity.
Unexpected shell commands spawned as child processes of the web server user.

Detection Strategies

Inspect web server access logs for POST requests to change-image.php followed by GET requests to files inside the upload directory.
Scan the application's upload directories for files whose extensions do not match their magic bytes.
Alert on web server processes spawning interpreters or shell binaries such as sh, bash, cmd.exe, or powershell.exe.

Monitoring Recommendations

Enable file integrity monitoring on the PHPGurukul Boat Booking System webroot, with priority on any directory writable by the application.
Forward web server access logs and PHP error logs to a central analytics platform for correlation.
Monitor authenticated session activity for repeated access to the Update Boat Image Page from unusual source IP addresses.

How to Mitigate CVE-2024-10161

Immediate Actions Required

Restrict access to change-image.php at the web server or WAF layer until validation controls are in place.
Remove PHP execution rights on the boat image upload directory using web server configuration.
Audit existing files in the upload directory and delete any file that is not a legitimate image.
Rotate credentials for all administrative accounts that could reach the Update Boat Image Page.

Patch Information

No vendor patch is currently referenced in the NVD entry for CVE-2024-10161. Track updates on the PHP Gurukul Website and the VulDB entry for remediation availability. Until a fix is released, administrators must apply compensating controls at the web server and application layer.

Workarounds

Enforce a strict allow-list of image extensions (.jpg, .jpeg, .png, .gif) and verify MIME type via magic-byte inspection before writing files to disk.
Rename all uploaded files to random identifiers and strip original extensions to prevent execution via double-extension tricks.
Store uploaded images outside the webroot or in a bucket served by a static file handler that does not invoke the PHP interpreter.
Deploy a web application firewall rule that blocks multipart uploads to change-image.php when the payload contains PHP tags or executable file signatures.

bash

# Apache configuration example to disable PHP execution in the uploads directory
<Directory "/var/www/boat-booking/images">
    php_admin_flag engine off
    <FilesMatch "\.(php|phtml|phar|php[0-9])$">
        Require all denied
    </FilesMatch>
</Directory>