CVE-2024-30510: Salon Booking System Path Traversal Flaw

CVE-2024-30510 Overview

CVE-2024-30510 is an Unrestricted Upload of File with Dangerous Type vulnerability affecting the Salon Booking System plugin for WordPress. This vulnerability allows attackers to upload files with dangerous types without proper validation, potentially enabling remote code execution on affected WordPress installations. The issue stems from insufficient file type restrictions in the upload functionality, classified as CWE-434 (Unrestricted Upload of File with Dangerous Type).

Critical Impact

This vulnerability allows unauthenticated attackers to upload arbitrary files, including malicious PHP scripts, to vulnerable WordPress sites running the Salon Booking System plugin. Successful exploitation can lead to complete site compromise, data theft, and server takeover.

Affected Products

• Salon Booking System plugin for WordPress versions through 9.5
• salonbookingsystem salon_booking_system

Discovery Timeline

• 2024-03-29 - CVE-2024-30510 published to NVD
• 2025-02-27 - Last updated in NVD database

Technical Details for CVE-2024-30510

Vulnerability Analysis

This vulnerability exists in the Salon Booking System WordPress plugin, which is used by salons and spas to manage online appointments and bookings. The core issue lies in the plugin's file upload handling mechanism, which fails to properly validate and restrict the types of files that can be uploaded through the application.

The vulnerability can be exploited remotely over the network without requiring authentication or user interaction. An attacker can leverage this flaw to upload arbitrary files, including web shells or malicious PHP scripts, to the target server. Once uploaded, these files can be executed to gain unauthorized access to the server, exfiltrate sensitive data, or pivot to attack other systems on the network.

The impact of successful exploitation is severe—attackers can achieve complete confidentiality, integrity, and availability compromise of the affected system. This includes the ability to read sensitive configuration files (such as wp-config.php), modify website content, access database credentials, and potentially compromise other sites hosted on the same server.

Root Cause

The root cause of CVE-2024-30510 is the lack of proper file type validation in the Salon Booking System plugin's upload functionality. The plugin fails to implement adequate server-side checks to verify that uploaded files conform to expected, safe file types. This allows attackers to bypass any client-side restrictions and upload executable files such as PHP scripts directly to the web server.

Specifically, the vulnerability is categorized under CWE-434, which describes scenarios where an application allows uploading of dangerous file types that can be automatically processed within the product's environment. In the context of WordPress and PHP, this means attackers can upload .php files that the web server will execute.

Attack Vector

The attack can be performed remotely over the network by any unauthenticated user who can access the WordPress site running the vulnerable plugin. The attack flow typically involves:

1. Identifying a WordPress installation with the Salon Booking System plugin version 9.5 or earlier
2. Locating the vulnerable file upload endpoint within the plugin
3. Crafting a malicious request that uploads a PHP web shell or backdoor file
4. Accessing the uploaded malicious file through the web server to execute arbitrary commands

Since no authentication or privileges are required, and no user interaction is needed, this vulnerability presents a straightforward attack surface for malicious actors. For detailed technical information, refer to the Patchstack Vulnerability Report.

Detection Methods for CVE-2024-30510

Indicators of Compromise

• Unexpected PHP files appearing in the WordPress wp-content/uploads/ directory or plugin directories, particularly files with suspicious names or obfuscated content
• Web server logs showing POST requests to the Salon Booking System plugin endpoints with file upload activity from unknown IP addresses
• Presence of web shells or backdoor files with common patterns such as eval(), base64_decode(), or system() functions in uploaded content
• Unauthorized modifications to WordPress core files, themes, or plugins following file upload activity

Detection Strategies

• Implement file integrity monitoring (FIM) to detect unauthorized file additions in the WordPress installation directory, especially in wp-content/ subdirectories
• Configure web application firewall (WAF) rules to inspect file upload requests and block uploads of executable file types (.php, .phtml, .php5, etc.)
• Monitor web server access logs for suspicious patterns targeting Salon Booking System endpoints
• Deploy endpoint detection and response (EDR) solutions like SentinelOne to detect malicious file writes and execution of web shells

Monitoring Recommendations

• Enable WordPress audit logging to track all file upload activities and administrative changes
• Set up alerts for new file creations in the wp-content/ directory tree with executable extensions
• Monitor outbound network connections from the web server for command-and-control communication patterns
• Regularly scan the WordPress installation with security plugins that can detect known web shell signatures

How to Mitigate CVE-2024-30510

Immediate Actions Required

• Update the Salon Booking System plugin to a version newer than 9.5 that includes the security fix
• Audit the WordPress wp-content/uploads/ directory and plugin directories for any suspicious files that may have been uploaded
• If an update is not immediately available, consider temporarily deactivating the Salon Booking System plugin until a patch is released
• Implement a web application firewall (WAF) rule to block file uploads to vulnerable endpoints as a temporary measure

Patch Information

Organizations should update the Salon Booking System plugin to the latest available version that addresses this vulnerability. Review the Patchstack Vulnerability Report for specific remediation guidance and patch availability. Always test updates in a staging environment before deploying to production.

Workarounds

• Configure the web server (Apache/Nginx) to prevent PHP execution in upload directories by adding directives that deny execution of scripts in wp-content/uploads/
• Implement server-side file type validation using .htaccess or Nginx configuration to only allow safe file types (images, documents) to be uploaded
• Use a WordPress security plugin to add additional file upload restrictions and malware scanning capabilities
• Consider implementing a Content Security Policy (CSP) and restricting file permissions on upload directories to prevent execution

# Apache .htaccess configuration to prevent PHP execution in uploads
# Add this to wp-content/uploads/.htaccess
<FilesMatch "\.(php|php5|phtml|phar)$">
    Order Deny,Allow
    Deny from all
</FilesMatch>