CVE-2024-1875: Razormist Complaint Management RCE Vulnerability

CVE-2024-1875 Overview

CVE-2024-1875 is an unrestricted file upload vulnerability in SourceCodester Complaint Management System 1.0, developed by razormist. The flaw resides in the users/register-complaint.php file within the Lodge Complaint Section component. Authenticated attackers can upload arbitrary files, including server-side scripts, leading to remote code execution on the host. The vulnerability is tracked as VDB-254723 and maps to CWE-434: Unrestricted Upload of File with Dangerous Type. A public exploit disclosure exists, increasing the likelihood of opportunistic attacks against exposed deployments.

Critical Impact
Remote authenticated attackers can upload web shells through the complaint lodging function and execute arbitrary code on the underlying web server.

Affected Products

SourceCodester Complaint Management System 1.0
razormist complaint_management_system 1.0
Deployments exposing users/register-complaint.php to network-reachable users

Discovery Timeline

2024-02-26 - CVE-2024-1875 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-1875

Vulnerability Analysis

The Complaint Management System exposes a file upload feature within the Lodge Complaint workflow. The users/register-complaint.php endpoint accepts user-supplied attachments intended to support complaint submissions. The application does not restrict the file type, extension, or MIME content of uploaded artifacts. An authenticated attacker can therefore upload PHP files that the web server subsequently interprets and executes.

Exploitation requires low privileges, no user interaction, and network access to the vulnerable endpoint. Successful attacks compromise confidentiality, integrity, and availability of the hosting environment. Because the uploaded payload runs in the context of the web server process, attackers gain a foothold suitable for lateral movement, credential theft, and database access.

Root Cause

The root cause is missing server-side validation on the file upload handler in users/register-complaint.php. The endpoint fails to enforce an allowlist of file extensions, verify MIME types, or store uploaded content outside the web root. This aligns with the CWE-434 weakness class, where dangerous file types can be written to an executable location.

Attack Vector

The attack proceeds over the network against an authenticated user session. An attacker registers or reuses a low-privilege account, navigates to the Lodge Complaint form, and submits a complaint with a PHP payload attached in place of a legitimate document or image. The application stores the file within a web-accessible directory. The attacker then requests the uploaded file directly, triggering PHP execution and achieving remote code execution. Public technical analysis is available in the Notion RCE writeup and the VulDB entry #254723.

Detection Methods for CVE-2024-1875

Indicators of Compromise

Unexpected .php, .phtml, or .phar files present in upload directories associated with the complaint module
Outbound network connections from the web server process to unfamiliar destinations following complaint submission activity
Web server access logs showing direct GET requests to uploaded attachment paths under the complaint workflow

Detection Strategies

Inspect the upload directory for files whose extensions differ from expected document or image formats
Correlate POST requests to users/register-complaint.php with subsequent GET requests to newly created files in web-served paths
Deploy web application firewall rules that inspect multipart uploads for embedded PHP tags such as <?php or <?=

Monitoring Recommendations

Enable file integrity monitoring on all web-accessible directories used by the Complaint Management System
Log and alert on process execution originating from the web server user, especially sh, bash, cmd.exe, or scripting interpreters
Retain HTTP access logs for the complaint endpoint and forward them to a centralized analytics platform for anomaly review

How to Mitigate CVE-2024-1875

Immediate Actions Required

Restrict network access to the Complaint Management System until a vetted patch or configuration hardening is applied
Disable the Lodge Complaint upload feature or place users/register-complaint.php behind additional authentication controls
Audit the upload directory and remove any files that are not legitimate complaint attachments

Patch Information

No vendor advisory or official patch has been published by razormist for SourceCodester Complaint Management System 1.0 at the time of writing. Operators should treat the application as unsupported and consider migrating to a maintained alternative. Refer to the VulDB CTI entry for tracking future remediation updates.

Workarounds

Configure the web server to deny execution of scripts within upload directories using directives such as php_admin_flag engine off or equivalent handler removal
Enforce an allowlist of file extensions and validate MIME types in a reverse proxy or web application firewall in front of the application
Store uploaded files outside the document root and serve them through a controlled download handler that sets safe content types

bash

# Apache example: disable PHP execution in the uploads directory
<Directory "/var/www/complaint_system/uploads">
    php_admin_flag engine off
    RemoveHandler .php .phtml .phar
    RemoveType .php .phtml .phar
    Options -ExecCGI
</Directory>