CVE-2024-2529: Online Event Hall Reservation System RCE

CVE-2024-2529 Overview

CVE-2024-2529 is an unrestricted file upload vulnerability in MAGESH-K21 Online-College-Event-Hall-Reservation-System version 1.0. The flaw resides in /admin/rooms.php and allows authenticated attackers to upload arbitrary files over the network. Successful exploitation typically leads to remote code execution on the underlying web server. The weakness is classified under CWE-434 (Unrestricted Upload of File with Dangerous Type). The vendor was contacted before public disclosure but did not respond, and no patch has been published.

Critical Impact
Authenticated remote attackers can upload web shells through /admin/rooms.php and achieve full compromise of confidentiality, integrity, and availability on the hosting server.

Affected Products

MAGESH-K21 Online-College-Event-Hall-Reservation-System 1.0
CPE: cpe:2.3:a:magesh-k21:online-college-event-hall-reservation-system:1.0
Deployments exposing /admin/rooms.php to network-reachable clients

Discovery Timeline

2024-03-16 - CVE-2024-2529 published to NVD with VulDB identifier VDB-256966
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-2529

Vulnerability Analysis

The vulnerability is an unrestricted file upload issue in the room management functionality of the reservation system. The /admin/rooms.php endpoint accepts file uploads without adequately validating file extension, MIME type, or content signature. Attackers with low-privilege authenticated access can submit a PHP file disguised as an image or supplied with a script extension. Because the uploaded file lands within the web root, requesting it triggers server-side execution of attacker-controlled code. This grants command execution in the context of the web server user and pivots into full application compromise.

Root Cause

The root cause is missing server-side validation on file uploads processed by /admin/rooms.php. The application relies on client-supplied metadata rather than enforcing an allow-list of safe file types, sanitizing filenames, or storing uploads outside of executable paths. This is a textbook CWE-434 weakness.

Attack Vector

Exploitation requires network access to the administrative interface and a valid low-privilege account. An attacker submits a crafted multipart form request to /admin/rooms.php containing a PHP payload, then requests the resulting file to trigger execution. A public proof of concept is documented in the GitHub PoC for CVE-2024-2529 and cataloged in VulDB #256966.

No verified exploit code is reproduced here. See the linked references for technical detail.

Detection Methods for CVE-2024-2529

Indicators of Compromise

POST requests to /admin/rooms.php containing multipart file uploads with executable extensions such as .php, .phtml, .phar, or double extensions like .jpg.php
New or modified files with script extensions appearing under application upload directories
Outbound network connections from the PHP process to unknown hosts following an upload event
Web server processes spawning shell interpreters such as sh, bash, or cmd.exe

Detection Strategies

Inspect web server access logs for POST requests to /admin/rooms.php followed by GET requests to newly created files under uploads paths
Deploy a web application firewall rule that blocks uploads whose content contains PHP tags (<?php, <?=) regardless of declared extension
Alert on file integrity monitoring events for any script file created under the reservation system's document root

Monitoring Recommendations

Forward web server, application, and endpoint telemetry to a centralized data lake for correlation across upload and execution events
Baseline legitimate administrator activity on /admin/rooms.php and flag deviations in file type or request volume
Monitor the web server user account for unexpected child processes, outbound connections, or credential access attempts

How to Mitigate CVE-2024-2529

Immediate Actions Required

Restrict network access to /admin/rooms.php using firewall, VPN, or IP allow-listing until an application-level fix is available
Rotate all administrator credentials and audit accounts with access to the reservation system
Review the application upload directory for unauthorized script files and remove any suspicious artifacts
Disable PHP execution within upload directories at the web server configuration level

Patch Information

No vendor patch is available. The vendor did not respond to the disclosure attempt recorded in VulDB CTI #256966. Operators should evaluate whether continued use of MAGESH-K21 Online-College-Event-Hall-Reservation-System 1.0 is acceptable and consider migrating to a maintained alternative.

Workarounds

Configure the web server to deny execution of PHP files in the uploads directory using .htaccess or equivalent Nginx location rules
Add server-side validation that enforces an allow-list of file extensions and verifies file content via magic-byte inspection
Rename uploaded files to non-executable, randomized identifiers and store them outside the web root where possible
Place the administrative interface behind an authenticating reverse proxy that inspects and blocks script payloads in multipart requests

bash

# Apache: block PHP execution in the uploads directory
# Place this .htaccess inside the uploads path
<FilesMatch "\.(php|phtml|phar|php5|php7)$">
    Require all denied
</FilesMatch>

# Nginx equivalent
# location ~* /uploads/.*\.(php|phtml|phar)$ {
#     deny all;
#     return 403;
# }