CVE-2024-1925: Ctcms 2.1.2 RCE Vulnerability

CVE-2024-1925 Overview

CVE-2024-1925 is an unrestricted file upload vulnerability in Ctcms 2.1.2, a PHP-based content management system. The flaw resides in ctcms/apps/controllers/admin/Upsys.php, where insufficient validation of uploaded files allows attackers to place arbitrary content on the server. The weakness maps to [CWE-434: Unrestricted Upload of File with Dangerous Type]. Exploitation occurs over the network without authentication or user interaction, though attack complexity is high. The exploit has been publicly disclosed under VulDB identifier VDB-254860.

Critical Impact
Successful exploitation can lead to arbitrary file placement on the web server, enabling potential remote code execution, full compromise of the host application, and lateral movement within the hosting environment.

Affected Products

Ctcms 2.1.2
Vendor: ctcms_project
CPE: cpe:2.3:a:ctcms_project:ctcms:2.1.2

Discovery Timeline

2024-02-27 - CVE-2024-1925 published to NVD
2024-12-18 - Last updated in NVD database

Technical Details for CVE-2024-1925

Vulnerability Analysis

The vulnerability is classified as an unrestricted file upload weakness ([CWE-434]) located in the administrative upload handler Upsys.php. The controller accepts file uploads without enforcing strict validation on file extensions, MIME types, or content signatures. As a result, an attacker can submit a file with executable server-side content (such as a PHP script) and have it stored within the web-accessible directory structure.

Once written, the attacker can invoke the file through a direct HTTP request, causing the web server to execute it under the application's privileges. This grants the attacker control over the CMS, its database credentials, and any other resources the web server process can reach.

The high attack complexity reflects conditions such as required knowledge of upload paths, possible token requirements, or constrained file naming behavior. The EPSS score is 0.597% with a percentile of 43.706, indicating limited but non-zero exploitation prediction.

Root Cause

The root cause is missing or inadequate server-side validation in the Upsys.php admin controller. The upload routine does not enforce an allowlist of permitted file types, does not normalize extensions, and does not verify file content before persisting to disk.

Attack Vector

The attack is initiated remotely by sending a crafted multipart HTTP request to the vulnerable admin upload endpoint. The malicious file is written to the server's filesystem, and the attacker subsequently requests the uploaded resource over HTTP to trigger execution. No prior authentication is required according to the CVE record, though the high complexity suggests specific conditions must be satisfied for reliable exploitation.

No verified proof-of-concept code is published in NVD. Technical details and disclosure artifacts are referenced in VulDB entry #254860 and the associated VulDB CTI record.

Detection Methods for CVE-2024-1925

Indicators of Compromise

Unexpected files with executable extensions (.php, .phtml, .phar) appearing under upload directories managed by Ctcms.
HTTP POST requests to administrative endpoints invoking Upsys.php from unfamiliar source IP addresses.
New PHP files in web roots with timestamps that do not match legitimate administrator activity.
Outbound network connections originating from the web server process to attacker-controlled infrastructure following an upload event.

Detection Strategies

Monitor web server access logs for POST requests to admin upload routes followed by GET requests to newly created files.
Deploy file integrity monitoring on Ctcms upload directories to alert on creation of script files.
Inspect multipart upload payloads at the web application firewall layer for executable content masquerading as benign file types.

Monitoring Recommendations

Enable verbose logging of all administrative actions within Ctcms, including file upload metadata.
Correlate web server process spawns of interpreters (php-cgi, shell processes) with recent upload activity.
Alert on web server processes writing files with executable extensions outside of expected deployment paths.

How to Mitigate CVE-2024-1925

Immediate Actions Required

Restrict access to the Ctcms administrative interface using IP allowlisting or VPN-only access until a patched release is deployed.
Audit existing upload directories for unauthorized files and remove any suspicious artifacts identified.
Disable PHP execution within upload directories at the web server configuration level.

Patch Information

No vendor advisory or official patch is referenced in the NVD record for CVE-2024-1925. Operators of Ctcms 2.1.2 should monitor the project for an updated release and review the VulDB entry for ongoing disclosure information.

Workarounds

Configure the web server to deny execution of scripts in user-writable upload directories using directives such as Apache php_admin_flag engine off or Nginx location blocks that disable the PHP handler.
Implement a strict server-side allowlist of permitted MIME types and file extensions in front of the application via a reverse proxy or WAF rule.
Rename uploaded files to non-executable extensions and store them outside the document root where feasible.

bash

# Example Nginx configuration to block script execution in Ctcms upload paths
location ~* ^/ctcms/uploads/.*\.(php|phtml|phar|php5|pl|py|jsp|asp|sh|cgi)$ {
    deny all;
    return 403;
}