CVE-2024-12954: Portfolio Management System MCA RCE Flaw

CVE-2024-12954 Overview

CVE-2024-12954 is an unrestricted file upload vulnerability in 1000 Projects Portfolio Management System MCA 1.0. The flaw resides in the /update_ach.php script, where the ach_certy parameter accepts attacker-controlled file uploads without proper validation. Remote attackers with low-level authentication can exploit this weakness over the network to place arbitrary files on the server. The issue is classified under CWE-284 (Improper Access Control) and has been publicly disclosed, increasing the risk of opportunistic exploitation against exposed installations.

Critical Impact

Authenticated remote attackers can upload arbitrary files through the ach_certy parameter in /update_ach.php, potentially leading to web shell deployment and server compromise.

Affected Products

• 1000 Projects Portfolio Management System MCA 1.0
• Component: /update_ach.php
• Parameter: ach_certy

Discovery Timeline

• 2024-12-26 - CVE-2024-12954 published to NVD
• 2025-04-22 - Last updated in NVD database

Technical Details for CVE-2024-12954

Vulnerability Analysis

The vulnerability exists in the file upload handler implemented in /update_ach.php. The application processes the ach_certy argument without enforcing restrictions on file type, extension, or MIME content. An authenticated user can submit a crafted multipart request that delivers an executable payload, such as a PHP web shell, into a web-accessible directory.

Because the affected route is reachable over the network and requires only low privileges, exploitation does not depend on administrator access. Once a malicious file lands in the server's document root, the attacker can request it directly to gain code execution within the web server context. This converts a file upload weakness into a foothold for further compromise, including data theft and lateral movement.

The public disclosure of exploitation details through VulDB and a public GitHub repository raises the probability of automated scanning against internet-exposed instances.

Root Cause

The root cause is missing access control and input validation on the upload endpoint. The handler does not validate the uploaded file's extension, MIME type, magic bytes, or storage location. It also fails to enforce authorization checks consistent with the sensitivity of the operation, classifying the defect under CWE-284.

Attack Vector

The attack vector is network-based. An attacker authenticates to the application with a low-privilege account, then issues a POST request to /update_ach.php containing a malicious file in the ach_certy field. After upload, the attacker browses to the file's URL to invoke the embedded payload. No user interaction is required beyond the attacker's own actions.

No verified exploit code is published in the references. See the GitHub CVE Project Repository and VulDB #289317 for the original disclosure details.

Detection Methods for CVE-2024-12954

Indicators of Compromise

• POST requests to /update_ach.php containing multipart form data in the ach_certy field with executable extensions such as .php, .phtml, or .phar.
• Newly created files with script extensions inside upload directories used by the Portfolio Management System.
• Outbound connections originating from the web server process shortly after an upload event.
• Web server access logs showing GET requests to recently uploaded files in user-writable paths.

Detection Strategies

• Inspect web server and PHP-FPM logs for /update_ach.php POST activity correlated with subsequent requests to files in the same upload path.
• Deploy file integrity monitoring on application directories to surface unexpected script files.
• Apply web application firewall rules that block uploads of executable content types to the ach_certy parameter.

Monitoring Recommendations

• Alert on any new .php or other interpreter-executable file created under web-accessible directories.
• Monitor for anomalous child processes spawned by the web server user, such as sh, bash, cmd.exe, or network utilities.
• Track authentication events that precede upload activity to identify compromised low-privilege accounts.

How to Mitigate CVE-2024-12954

Immediate Actions Required

• Restrict network access to the Portfolio Management System MCA application to trusted users only, ideally behind a VPN.
• Disable or remove the /update_ach.php endpoint if it is not required for business operations.
• Audit upload directories for unauthorized files and remove any suspicious scripts.
• Rotate credentials for accounts that could reach the affected endpoint.

Patch Information

No vendor patch has been published in the available references. Administrators should consult the 1000 Projects Resource Hub for updates and consider replacing the application if no fix is released. Tracking entries are available at VulDB CTI ID #289317.

Workarounds

• Configure the web server to deny execution of scripts within upload directories using directives such as php_admin_flag engine off or equivalent rules.
• Add a web application firewall signature that blocks multipart uploads to /update_ach.php containing executable file extensions or PHP tags in file content.
• Enforce server-side validation through a wrapper script that checks file extension, MIME type, and magic bytes before storage.
• Move upload storage outside of the web root and serve files through a controlled download handler.

# Example Apache configuration to prevent script execution in uploads
<Directory "/var/www/portfolio_mca/uploads">
    php_admin_flag engine off
    AddType text/plain .php .phtml .phar .php5 .php7
    Options -ExecCGI
</Directory>