CVE-2024-3369: Anisha Car Rental RCE Vulnerability

CVE-2024-3369 Overview

CVE-2024-3369 is an unrestricted file upload vulnerability in code-projects Car Rental 1.0. The flaw resides in the add-vehicle.php script, where the Upload Image parameter fails to validate uploaded file types. Attackers with low-privileged access can upload arbitrary files, including server-side scripts, to the web application. The exploit has been publicly disclosed and can be launched remotely over the network. The issue is tracked as VulDB identifier VDB-259490 and is classified under [CWE-434] Unrestricted Upload of File with Dangerous Type.

Critical Impact
Successful exploitation allows authenticated attackers to upload web shells and achieve remote code execution on the underlying web server.

Affected Products

code-projects Car Rental 1.0
Anisha Car Rental 1.0
Deployments referencing the vulnerable add-vehicle.php upload handler

Discovery Timeline

2024-04-06 - CVE-2024-3369 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-3369

Vulnerability Analysis

The vulnerability exists in the vehicle registration workflow of Car Rental 1.0. The add-vehicle.php endpoint accepts a file through the Upload Image form field intended for vehicle photographs. The application does not enforce MIME type checks, file extension whitelisting, or content validation before writing the file to a web-accessible directory.

An authenticated attacker can substitute a PHP payload for the expected image file. Once uploaded, the file is reachable through the web server and executed by the PHP interpreter. This grants the attacker code execution in the context of the web server process.

The network-accessible attack surface and the confidentiality, integrity, and availability impacts reflect a scenario in which uploaded code runs with the same privileges as the web application. Because the platform is a small business application typically deployed on shared hosting or LAMP stacks, exploitation frequently leads to full application compromise.

Root Cause

The root cause is missing server-side validation of uploaded file content and extension in add-vehicle.php. The handler trusts client-supplied metadata and writes files directly into an executable directory. This maps to [CWE-434] Unrestricted Upload of File with Dangerous Type.

Attack Vector

An attacker authenticates to the Car Rental application with low-privileged credentials, navigates to the add-vehicle workflow, and submits a crafted multipart form request. The Upload Image field carries a PHP file rather than an image. After upload, the attacker requests the file URL to trigger execution and establish an interactive foothold.

No verified proof-of-concept code is published in the referenced advisories. Technical details are available in the VulDB entry #259490 and the supporting submission document.

Detection Methods for CVE-2024-3369

Indicators of Compromise

Files with .php, .phtml, .phar, or double extensions such as .jpg.php present in vehicle image upload directories
HTTP POST requests to add-vehicle.php containing multipart payloads with non-image Content-Type values
Unexpected outbound network connections originating from the web server process shortly after upload activity
New administrative users or modified database records created without a corresponding legitimate session

Detection Strategies

Alert on write operations to web-accessible directories that produce files with server-executable extensions
Inspect web server access logs for GET requests to files in the vehicle image directory that return non-image content types
Correlate authentication events against add-vehicle.php submissions to identify anomalous upload frequency from a single account

Monitoring Recommendations

Enable file integrity monitoring on the Car Rental webroot, focusing on upload directories
Forward web server, PHP, and application logs to a centralized analytics platform for retention and correlation
Baseline normal upload volume and file types per user account, then alert on deviations

How to Mitigate CVE-2024-3369

Immediate Actions Required

Restrict access to add-vehicle.php to trusted networks or administrative users until a validated fix is in place
Audit the vehicle image upload directory for unexpected script files and remove any that are not legitimate images
Rotate credentials for all Car Rental administrative accounts and review recent authentication logs
Disable PHP execution in upload directories through web server configuration

Patch Information

No vendor patch is referenced in the NVD advisory or the associated VulDB record at the time of publication. Operators of code-projects Car Rental 1.0 should assume the deployed code base remains vulnerable and apply compensating controls. Monitor the vendor project page and VulDB for updates.

Workarounds

Enforce a server-side allowlist of image MIME types and extensions in the upload handler and reject any request that does not match
Store uploaded files outside the web root and serve them through a controlled script that sets a static Content-Type
Deploy a web application firewall rule that blocks multipart uploads to add-vehicle.php containing PHP tags or executable extensions
Configure the web server to treat the upload directory as static content only, for example with an Apache .htaccess that disables the PHP handler

bash

# Apache: disable PHP execution in the vehicle image upload directory
# Place this .htaccess file inside the upload folder
<FilesMatch "\.(php|phtml|phar|php3|php4|php5|php7)$">
    Require all denied
</FilesMatch>
RemoveHandler .php .phtml .phar
RemoveType .php .phtml .phar
php_flag engine off