CVE-2024-2561: 74cms Unrestricted Upload RCE Vulnerability

CVE-2024-2561 Overview

CVE-2024-2561 is an unrestricted file upload vulnerability in 74CMS version 3.28.0, a PHP-based recruitment content management system. The flaw resides in the sendCompanyLogo function within /controller/company/Index.php, part of the Company Logo Handler component. Attackers manipulate the imgBase64 argument to upload arbitrary files to the server. The vulnerability requires low-privilege authentication and is exploitable over the network. Public proof-of-concept code is available, increasing the likelihood of exploitation attempts against exposed instances. The issue is tracked in VulDB as entry 257060 and maps to CWE-434: Unrestricted Upload of File with Dangerous Type.

Critical Impact
Authenticated remote attackers can upload arbitrary files through the imgBase64 parameter, enabling potential webshell deployment and remote code execution on affected 74CMS 3.28.0 servers.

Affected Products

74CMS version 3.28.0
Component: Company Logo Handler (/controller/company/Index.php)
Vulnerable function: sendCompanyLogo

Discovery Timeline

2024-03-17 - CVE-2024-2561 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-2561

Vulnerability Analysis

The vulnerability exists in the sendCompanyLogo function of 74CMS 3.28.0, which handles company logo uploads through a base64-encoded payload. The function accepts the imgBase64 parameter without validating the decoded content's file type, extension, or MIME. Attackers submit a base64-encoded payload containing arbitrary content, such as a PHP webshell, which the handler writes to a web-accessible directory.

Successful exploitation grants attackers the ability to execute arbitrary code within the web server context. This leads to full application compromise, data theft, lateral movement, and persistent access. The vulnerability requires only a low-privilege authenticated session, which is trivially obtainable on 74CMS deployments that permit public company registration.

Root Cause

The root cause is missing input validation on user-supplied file content [CWE-434]. The sendCompanyLogo handler trusts the imgBase64 argument and writes the decoded bytes to disk without enforcing an allowlist of image formats, verifying magic bytes, or restricting the output file extension.

Attack Vector

An authenticated attacker sends a crafted HTTP request to the company logo endpoint. The imgBase64 parameter contains base64-encoded PHP code disguised as an image payload. The server decodes and saves the payload to a predictable path within the web root. The attacker then requests the saved file directly, triggering PHP execution and gaining code execution on the host.

A public proof-of-concept demonstrating the exploitation flow is available on GitHub Gist.

Detection Methods for CVE-2024-2561

Indicators of Compromise

Unexpected .php, .phtml, or double-extension files (for example logo.jpg.php) inside 74CMS upload directories used for company logos.
POST requests to endpoints backed by /controller/company/Index.php containing large imgBase64 values that decode to non-image content.
Web server access logs showing GET requests directly targeting files under the company logo upload directory shortly after a POST upload.
New PHP processes spawning shell utilities (sh, bash, cmd.exe) from the web server user context.

Detection Strategies

Inspect base64 payloads in imgBase64 parameters and flag decoded content whose magic bytes do not match JPEG, PNG, or GIF signatures.
Correlate authenticated company-account activity with file writes to the web root and subsequent direct requests to those files.
Alert on PHP interpreter execution originating from upload directories that should serve only static assets.

Monitoring Recommendations

Enable file integrity monitoring on 74CMS upload directories to detect unauthorized file creation.
Log and review all requests to sendCompanyLogo and related company controller endpoints.
Monitor outbound network connections from the web server for reverse shell or C2 traffic following logo uploads.

How to Mitigate CVE-2024-2561

Immediate Actions Required

Restrict access to the 74CMS company registration and logo upload endpoints to trusted networks or authenticated administrators until a fix is applied.
Configure the web server to disable PHP execution within upload directories using .htaccess rules or equivalent nginx location directives.
Audit existing upload directories for suspicious files created since the 74CMS 3.28.0 deployment date and remove any unauthorized content.
Rotate credentials and session tokens for any company accounts that interacted with the logo upload feature.

Patch Information

No vendor advisory or official patch is referenced in the NVD entry for CVE-2024-2561. Operators of 74CMS 3.28.0 should monitor the vendor's release channels for a fixed version and, in the interim, apply the workarounds below. Additional technical context is available at VulDB entry 257060.

Workarounds

Add server-side validation in sendCompanyLogo to decode the imgBase64 payload, verify image magic bytes, and reject any content that is not a valid JPEG, PNG, or GIF.
Force uploaded files to a fixed, safe extension (for example .jpg) and store them outside the executable web root, serving them through a static file proxy.
Deploy a web application firewall rule that inspects imgBase64 parameters and blocks payloads whose base64-decoded prefix contains PHP tags (<?php, <?=) or script markers.
Disable PHP handlers within upload paths at the web server configuration level to neutralize any files that bypass application-level checks.

bash

# Example nginx configuration to block PHP execution in 74CMS upload paths
location ~* ^/upload/.*\.(php|phtml|php5|phar)$ {
    deny all;
    return 403;
}