CVE-2024-3436: Fast5 Prison Management System RCE Flaw

CVE-2024-3436 Overview

CVE-2024-3436 is an unrestricted file upload vulnerability in SourceCodester Prison Management System 1.0. The flaw resides in the Avatar Handler component, specifically the /Admin/edit-photo.php script. Attackers can manipulate the avatar parameter to upload arbitrary files to the server, enabling remote code execution when the uploaded file is later requested. The vulnerability has been publicly disclosed with proof-of-concept material available, and it is tracked under Vulnerability Database identifier VDB-259630. The weakness maps to [CWE-434] Unrestricted Upload of File with Dangerous Type. Exploitation requires an authenticated administrative session but can be conducted over the network.

Critical Impact
Authenticated attackers can upload malicious PHP files through the avatar editing feature, achieving remote code execution on the underlying web server.

Affected Products

Fast5 Prison Management System 1.0
SourceCodester Prison Management System 1.0
Deployments referencing the CPE cpe:2.3:a:fast5:prison_management_system:1.0

Discovery Timeline

2024-04-08 - CVE-2024-3436 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-3436

Vulnerability Analysis

The vulnerability exists in the avatar update workflow of the administrative interface. When an administrator submits a new profile picture through /Admin/edit-photo.php, the application processes the avatar request parameter without validating the file type, extension, or MIME content. The absence of an allowlist for image formats permits attackers to upload PHP scripts or other executable server-side content. Once written to a web-accessible directory, the file can be requested directly through the browser, causing the PHP interpreter to execute the attacker-supplied code. This grants command execution in the context of the web server user, exposing database credentials, inmate records, and any additional services accessible from the host.

Root Cause

The root cause is missing input validation on file uploads, classified as [CWE-434] Unrestricted Upload of File with Dangerous Type. The edit-photo.php endpoint accepts the avatar parameter without enforcing extension checks, content-type verification, or rewriting the stored filename to a safe value. The application also stores the uploaded file in a directory served directly by the web server, allowing subsequent execution.

Attack Vector

Exploitation requires authenticated administrative access to the Prison Management System console. The attacker crafts a multipart HTTP POST request to /Admin/edit-photo.php containing a PHP webshell disguised as an avatar image. After the upload succeeds, the attacker requests the stored file path to trigger interpreter execution. Public proof-of-concept material is documented in the GitHub CVE PoC Documentation and additional context is available at the VulDB ID #259630 entry.

No verified exploit code snippet is included here. Refer to the linked references for reproduction details.

Detection Methods for CVE-2024-3436

Indicators of Compromise

Presence of .php, .phtml, .phar, or other executable files inside the avatar or uploads directory served by the Prison Management System
HTTP POST requests to /Admin/edit-photo.php containing non-image Content-Type values or filenames with double extensions such as image.jpg.php
Web server access logs showing GET requests to newly created files in the avatar upload path shortly after an administrator session
Outbound network connections initiated by the PHP-FPM or Apache worker process following an avatar upload event

Detection Strategies

Monitor file system changes in the web root and alert on the creation of scripting extensions inside directories intended for user-supplied images
Deploy web application firewall rules that inspect multipart uploads to /Admin/edit-photo.php and block requests where file magic bytes do not match declared image types
Correlate authentication events with file upload activity to identify anomalous administrator behavior or session reuse from unfamiliar source addresses

Monitoring Recommendations

Enable verbose access logging on the Prison Management System web server and forward logs to a centralized platform for retention and query
Track process ancestry on the host so that shell processes spawned by the web server user trigger alerts
Baseline the contents of avatar storage directories and alert on files that exceed expected sizes or contain server-side script markers such as <?php

How to Mitigate CVE-2024-3436

Immediate Actions Required

Restrict network access to the /Admin path so that only trusted management workstations can reach the administrative interface
Rotate credentials for all administrator accounts and audit sessions for unauthorized access following the disclosure
Inspect the avatar upload directory for unexpected files and remove any server-side scripts discovered during triage
Rebuild any host suspected of compromise from a known-good image rather than attempting in-place cleanup

Patch Information

No vendor advisory or official patch has been published for Fast5 Prison Management System 1.0 at the time of the last NVD update. Operators should evaluate whether continued use of the application is acceptable given the public proof of concept. If the application must remain in production, apply the workarounds below and consider forking the source to add server-side validation on /Admin/edit-photo.php.

Workarounds

Modify edit-photo.php to enforce an allowlist of image extensions (.jpg, .jpeg, .png, .gif) and verify file magic bytes before writing to disk
Configure the web server to deny script execution inside the avatar upload directory by disabling PHP handlers for that path
Rename uploaded files to server-generated identifiers so that attackers cannot control the resulting extension or filename
Place the application behind a reverse proxy or web application firewall that inspects uploads and blocks non-image payloads

bash

# Apache configuration example to disable PHP execution in the uploads directory
<Directory "/var/www/prison_management_system/Admin/uploads">
    php_admin_flag engine off
    <FilesMatch "\.(php|phtml|phar|php5|php7)$">
        Require all denied
    </FilesMatch>
</Directory>