CVE-2024-2754: Complete E-commerce Site RCE Vulnerability

CVE-2024-2754 Overview

CVE-2024-2754 is an unrestricted file upload vulnerability in SourceCodester Complete E-Commerce Site 1.0, developed by donbermoy. The flaw resides in the /admin/users_photo.php file, where the photo parameter accepts uploads without proper validation. Authenticated attackers can upload arbitrary files, including server-side scripts, and execute them remotely. The vulnerability is tracked as VDB-257544 and maps to CWE-434 (Unrestricted Upload of File with Dangerous Type). Public disclosure of the exploit technique increases the likelihood of opportunistic attacks against exposed installations.

Critical Impact
Remote attackers with low-privilege access can upload malicious files to /admin/users_photo.php, leading to arbitrary code execution, full application compromise, and potential lateral movement into the underlying host.

Affected Products

donbermoy Complete E-Commerce Site 1.0
Deployments exposing the /admin/users_photo.php endpoint
Web servers hosting the vulnerable PHP application

Discovery Timeline

2024-03-21 - CVE-2024-2754 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-2754

Vulnerability Analysis

The vulnerability exists in the administrative user photo upload handler at /admin/users_photo.php. The application accepts the photo parameter without validating the file type, extension, MIME content, or magic bytes. An attacker with access to the admin interface can submit a request that uploads a PHP file disguised or served directly as executable code. Once written to a web-accessible directory, the file can be requested via HTTP to trigger server-side execution. Because the attack is network-reachable and requires only low-privilege authentication, exploitation delivers a direct path from authenticated web access to remote code execution on the host.

Root Cause

The root cause is missing server-side validation of user-supplied file uploads, classified under CWE-434. The users_photo.php handler does not enforce an allowlist of permitted extensions, verify the MIME type, or store uploaded files outside the web root. The application also fails to rename uploaded files or strip executable extensions, allowing attacker-controlled content to be served as PHP.

Attack Vector

Exploitation requires network access to the admin interface and valid low-privilege credentials. The attacker submits a multipart form POST to /admin/users_photo.php containing a file with an executable extension such as .php or .phtml in the photo field. After the upload succeeds, the attacker requests the resulting URL to execute the payload. Refer to the GitHub Issue Report and VulDB entry #257544 for the disclosed proof-of-concept.

Detection Methods for CVE-2024-2754

Indicators of Compromise

POST requests to /admin/users_photo.php containing filenames with .php, .phtml, .php5, or double-extension patterns such as image.jpg.php
New or modified PHP files in the application's user photo upload directory that were not written by the deployment pipeline
Outbound network connections from the web server process (php-fpm, apache) to unexpected destinations following an upload event
Web shell command patterns such as cmd=, system(, or base64_decode( in access logs targeting user photo paths

Detection Strategies

Inspect web server access logs for POST requests to /admin/users_photo.php followed by GET requests to files in the upload directory with script extensions
Deploy file integrity monitoring on the upload directory to flag creation of executable content
Configure WAF rules to block multipart uploads where the photo parameter contains disallowed extensions or PHP shebangs

Monitoring Recommendations

Alert on new process spawns from the web server user account, particularly shells and network utilities such as bash, nc, curl, or wget
Monitor authentication logs for admin session creation from unusual source IPs preceding upload activity
Track file writes to web-accessible directories and correlate with the initiating HTTP request

How to Mitigate CVE-2024-2754

Immediate Actions Required

Restrict network access to /admin/ paths using IP allowlists, VPN, or reverse proxy authentication until a fix is applied
Rotate all administrator credentials and enforce strong, unique passwords
Audit the upload directory for unauthorized files and remove any that were not written by legitimate application flows
Disable PHP execution in upload directories via web server configuration

Patch Information

No official vendor patch has been published for CVE-2024-2754 at the time of writing. The disclosure is documented in the GitHub Issue Report and the VulDB CTI record. Operators should treat this application as unmaintained and evaluate migration to a supported e-commerce platform.

Workarounds

Configure the web server to deny execution of PHP files under the upload directory using directives such as Apache php_flag engine off or an Nginx location block that only serves static content
Add server-side validation to users_photo.php enforcing an allowlist of image extensions (.jpg, .png, .gif) and verifying MIME type using finfo_file()
Rename uploaded files to random identifiers and strip all extensions except the validated image type
Store uploaded files outside the web root and serve them through a controlled handler script

bash

# Nginx configuration example: block script execution in upload directory
location ^~ /admin/uploads/ {
    location ~ \.(php|phtml|php5|pl|py|cgi|sh)$ {
        deny all;
        return 403;
    }
    default_type application/octet-stream;
}