CVE-2024-2531: Online-College-Event-Hall RCE Vulnerability

CVE-2024-2531 Overview

CVE-2024-2531 is an unrestricted file upload vulnerability in MAGESH-K21 Online-College-Event-Hall-Reservation-System version 1.0. The flaw resides in the /admin/update-rooms.php endpoint, which fails to validate uploaded file types. Authenticated attackers can upload arbitrary files, including server-side scripts, and execute them remotely. The issue is tracked in VulDB as entry VDB-256968 and is classified under CWE-434: Unrestricted Upload of File with Dangerous Type. The vendor was contacted before public disclosure but did not respond. Exploit details are publicly available, increasing the risk of opportunistic exploitation against exposed installations.

Critical Impact
Authenticated attackers can upload web shells through /admin/update-rooms.php and achieve remote code execution on the web server hosting the reservation application.

Affected Products

MAGESH-K21 Online-College-Event-Hall-Reservation-System 1.0
CPE: cpe:2.3:a:magesh-k21:online-college-event-hall-reservation-system:1.0:*:*:*:*:*:*:*
Component: magesh-k21:online-college-event-hall-reservation-system

Discovery Timeline

2024-03-16 - CVE-2024-2531 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-2531

Vulnerability Analysis

The vulnerability is an unrestricted file upload flaw in the administrative interface of the reservation application. The /admin/update-rooms.php script accepts file uploads without enforcing extension, MIME type, or content validation. An authenticated user with access to the admin panel can submit a PHP file disguised as a room image or supporting asset. Because the file is written to a web-accessible directory, requesting the uploaded resource causes the PHP interpreter to execute attacker-supplied code. This yields arbitrary command execution under the privileges of the web server process. The EPSS probability of 0.694% reflects modest observed exploitation activity, but public proof-of-concept material lowers the barrier for opportunistic attackers.

Root Cause

The root cause is missing input validation on the file upload handler in update-rooms.php. The endpoint does not enforce an allowlist of file extensions, does not verify MIME type against file content, and does not rename or sanitize uploaded filenames. The upload directory is served by the web server with PHP execution enabled, converting the file write primitive into a code execution primitive.

Attack Vector

Exploitation requires network access to the application and low-privileged authenticated access to the administrative area. The attacker submits a crafted multipart form request to /admin/update-rooms.php containing a PHP payload with a .php extension. After upload, the attacker requests the file directly from the web-accessible uploads path. The server executes the payload, granting a foothold suitable for reconnaissance, credential theft, database access, or lateral movement. Publicly disclosed exploitation details are documented in the GitHub PoC for Arbitrary File Upload and the VulDB Analysis #256968.

Detection Methods for CVE-2024-2531

Indicators of Compromise

POST requests to /admin/update-rooms.php containing multipart file uploads with .php, .phtml, .phar, or double-extension filenames.
New or unexpected script files appearing in the application's uploads/ or rooms/ image directory.
Outbound connections initiated by the web server process (php-fpm, apache2, httpd) to unfamiliar IP addresses shortly after admin activity.
Web server process spawning shell interpreters such as sh, bash, or cmd.exe.

Detection Strategies

Inspect web server access logs for successful POST requests to /admin/update-rooms.php followed by GET requests to newly written files in upload directories.
Alert on filesystem write events that create executable script extensions under directories served by the web server.
Correlate admin authentication events with subsequent file uploads to identify anomalous session behavior or brute-forced admin accounts.

Monitoring Recommendations

Enable file integrity monitoring on the application's document root and upload directories.
Forward web server logs, filesystem audit logs, and process telemetry to a central analytics platform for correlation.
Monitor for web server processes spawning unexpected child processes, which typically indicates web shell activity.

How to Mitigate CVE-2024-2531

Immediate Actions Required

Remove the application from public network exposure until a fix is applied, or place it behind a VPN or IP allowlist.
Audit the uploads directory for unauthorized script files and remove any that are not part of the expected asset set.
Rotate all administrative credentials for the application and any reused elsewhere.
Review web server and database logs for signs of prior exploitation.

Patch Information

No vendor patch is available. The vendor did not respond to disclosure attempts, per the VulDB advisory. Organizations running MAGESH-K21 Online-College-Event-Hall-Reservation-System 1.0 should treat the software as unmaintained and plan migration to a supported alternative.

Workarounds

Configure the web server to deny script execution within upload directories using php_admin_flag engine off in Apache or an equivalent location block in nginx.
Add server-side validation that enforces an allowlist of image extensions and verifies file contents match declared MIME types before accepting uploads.
Deploy a web application firewall rule that blocks multipart uploads to /admin/update-rooms.php containing PHP tags or executable extensions.
Restrict access to /admin/ paths using network-level controls or HTTP basic authentication in front of the application.

bash

# Apache: disable PHP execution within the uploads directory
<Directory "/var/www/reservation/uploads">
    php_admin_flag engine off
    AddType text/plain .php .phtml .phar .php5 .php7
    Options -ExecCGI
</Directory>