CVE-2024-10410: Janobe Hotel Reservation System RCE Flaw

CVE-2024-10410 Overview

CVE-2024-10410 is an unrestricted file upload vulnerability in the Janobe/SourceCodester Online Hotel Reservation System 1.0. The flaw resides in the upload function within /admin/mod_room/controller.php?action=add. Attackers can manipulate the image parameter to upload arbitrary files to the server. The issue is classified under CWE-434: Unrestricted Upload of File with Dangerous Type. The exploit has been publicly disclosed and can be triggered remotely by an authenticated low-privilege user.

Critical Impact
Authenticated attackers can upload arbitrary files through the room management module, potentially enabling web shell deployment and remote code execution on the hosting server.

Affected Products

Janobe Online Hotel Reservation System 1.0
SourceCodester Online Hotel Reservation System 1.0
Deployments hosting /admin/mod_room/controller.php

Discovery Timeline

2024-10-27 - CVE-2024-10410 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-10410

Vulnerability Analysis

The vulnerability exists in the room management controller of the Online Hotel Reservation System. The add action invokes an upload function that accepts an image argument without validating file type, extension, or content. An authenticated administrator-panel user can submit a crafted multipart request that places arbitrary content into the application's uploads directory. Because PHP files placed under the web root remain executable, this weakness typically results in web shell installation and full server compromise. The application processes uploaded content server-side and does not enforce MIME sniffing, allowlist extensions, or rename uploaded artifacts to non-executable formats.

Root Cause

The root cause is missing input validation on the image upload handler in /admin/mod_room/controller.php. The controller trusts client-supplied filenames and content types, storing files directly under a web-accessible path. This aligns with CWE-434, where dangerous file types are accepted by the upload interface.

Attack Vector

The attack is remote and network-based. An attacker with low-privilege access to the admin module sends a POST request to /admin/mod_room/controller.php?action=add containing a malicious file (for example, a PHP script) in the image field. Once written to disk, the attacker requests the uploaded file via HTTP to execute code in the web server context. Public proof-of-concept details are available in the GitHub PoC Repository and VulDB #281953.

No verified exploit code is included here. Refer to the VulDB Submission #431502 for further technical detail.

Detection Methods for CVE-2024-10410

Indicators of Compromise

New files with executable extensions such as .php, .phtml, or .php5 appearing under the application's room image upload directory.
Web server access logs showing POST requests to /admin/mod_room/controller.php?action=add followed by GET requests to newly created files in the uploads path.
Outbound network connections initiated from the web server process to unknown external hosts after upload activity.

Detection Strategies

Alert on any file written to upload directories where the extension does not match an allowlist of image formats (.jpg, .png, .gif).
Correlate POST requests to /admin/mod_room/controller.php with subsequent execution of PHP interpreter processes spawning shells such as sh, bash, or cmd.exe.
Inspect uploaded content headers and file magic bytes; flag mismatches between declared MIME type and actual content.

Monitoring Recommendations

Enable web application firewall rules that block multipart uploads containing PHP tags or executable content signatures.
Monitor the web server user account for unexpected child process creation, which frequently indicates web shell activity.
Retain and centralize web server access logs and file integrity monitoring events for the application's document root.

How to Mitigate CVE-2024-10410

Immediate Actions Required

Restrict administrative access to /admin/mod_room/controller.php using network ACLs or authentication proxies until a patch is applied.
Audit the uploads directory for unexpected files and remove any suspicious artifacts.
Rotate administrator credentials and review recent admin panel activity for signs of abuse.

Patch Information

No vendor patch is currently referenced in the NVD entry or vendor advisories for CVE-2024-10410. Operators should consult the SourceCodester Security Blog for vendor updates and consider decommissioning affected deployments until a fix is available.

Workarounds

Modify the upload handler to validate file extensions against an allowlist of image formats and reject all other content.
Store uploaded files outside the web root or in a directory where script execution is disabled via web server configuration.
Rename uploaded files to random identifiers without preserving the original extension to prevent direct execution.
Deploy a WAF rule that blocks uploads containing PHP tags or shell metacharacters targeting the mod_room endpoint.

bash

# Example Apache configuration to disable PHP execution in uploads directory
<Directory "/var/www/hotel/uploads">
    php_admin_flag engine off
    <FilesMatch "\.(php|phtml|php5|phar)$">
        Require all denied
    </FilesMatch>
</Directory>