CVE-2024-2148: Online Mobile Store System RCE Vulnerability

CVE-2024-2148 Overview

CVE-2024-2148 is an unrestricted file upload vulnerability in SourceCodester Online Mobile Management Store 1.0, developed by oretnom23. The flaw resides in the /classes/Users.php file, where the img parameter fails to validate uploaded file content or extension. An authenticated attacker can upload a malicious PHP file and achieve remote code execution on the underlying web server. The weakness is classified under [CWE-434: Unrestricted Upload of File with Dangerous Type]. The exploit has been publicly disclosed through VulDB entry #255501 and a GitHub proof-of-concept, increasing the likelihood of opportunistic attacks against exposed installations.

Critical Impact
Remote attackers with low privileges can upload arbitrary PHP files through /classes/Users.php and execute code on the host, leading to full application compromise.

Affected Products

Oretnom23 Online Mobile Store Management System 1.0
SourceCodester Online Mobile Management Store 1.0
Deployments referenced by CPE cpe:2.3:a:oretnom23:online_mobile_store_management_system:1.0

Discovery Timeline

2024-03-03 - CVE-2024-2148 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-2148

Vulnerability Analysis

The vulnerability affects the user profile handling logic in /classes/Users.php. The endpoint accepts a file through the img parameter, which is intended for profile picture uploads. The application writes the uploaded file to a web-accessible directory without validating the file type, extension, or MIME content. Attackers can substitute a PHP web shell in place of an image and request it directly through the web server to trigger execution.

Successful exploitation grants the attacker the ability to run arbitrary server-side code under the privileges of the web server process. This typically leads to database credential theft, lateral movement, and persistent backdoor installation. Because the application is a management platform for mobile inventory, compromise also exposes customer records and transactional data. Technical exploitation details are documented in the GitHub PoC repository.

Root Cause

The root cause is missing server-side validation of the uploaded file. The handler does not enforce an allowlist of extensions, does not verify magic bytes, and stores files under their original names in a directory served by the PHP interpreter. This combination violates the guidance in CWE-434 and permits any authenticated user to place executable content on the server.

Attack Vector

The attack is delivered over the network against the application's authenticated user interface. An attacker with a low-privileged account submits a multipart request to the profile update endpoint containing a .php payload in the img field. After upload, the attacker navigates to the resulting file path and executes commands directly through the web shell.

No verified exploitation code is included here. See the GitHub PoC repository and VulDB #255501 for reproduction steps.

Detection Methods for CVE-2024-2148

Indicators of Compromise

PHP files present in user-uploaded image directories, particularly files whose names contain the img parameter value
HTTP POST requests to /classes/Users.php carrying multipart payloads with non-image Content-Type values or .php, .phtml, or .phar extensions
Web server access logs showing GET requests to uploaded files immediately after a POST to Users.php
Outbound network connections initiated by the PHP-FPM or Apache worker process to unfamiliar external hosts

Detection Strategies

Inspect Users.php upload directories for files whose extensions do not match image MIME types
Deploy web application firewall rules that block multipart uploads containing PHP tags or script directives
Correlate authenticated session activity with new file creation events in the web root using file integrity monitoring

Monitoring Recommendations

Alert on child processes spawned by the web server user, such as sh, bash, or python
Monitor for creation of files with executable extensions in directories served by the web application
Track unusual outbound connections from web server hosts to detect post-exploitation callbacks

How to Mitigate CVE-2024-2148

Immediate Actions Required

Restrict access to the Online Mobile Management Store application until validation controls are added to /classes/Users.php
Audit web-accessible upload directories and remove any files that do not match expected image types
Rotate database credentials and session secrets if evidence of file upload abuse is found
Disable PHP execution in directories that store user-uploaded content

Patch Information

No vendor patch is currently referenced in the NVD entry or vendor advisory sources for CVE-2024-2148. Operators should treat the application as unmaintained and apply compensating controls. Track the VulDB entry for future updates.

Workarounds

Configure the web server to serve upload directories with AddType text/plain .php or equivalent to prevent PHP interpretation
Add server-side validation that enforces an allowlist of image extensions and verifies magic bytes before saving
Rename uploaded files to random identifiers and strip the original extension
Place the application behind an authenticating reverse proxy to limit exposure to trusted users only

bash

# Apache configuration example to disable PHP execution in the upload directory
<Directory "/var/www/html/uploads">
    php_admin_flag engine off
    AddType text/plain .php .phtml .phar .php5
    Options -ExecCGI
</Directory>