CVE-2024-3437: Fast5 Prison Management System RCE Flaw

CVE-2024-3437 Overview

CVE-2024-3437 is an unrestricted file upload vulnerability in SourceCodester Prison Management System 1.0. The flaw resides in the Avatar Handler component, specifically in /Admin/add-admin.php. Attackers manipulate the avatar parameter to upload arbitrary files without restriction. The vulnerability is exploitable remotely without authentication or user interaction. Public disclosure includes proof-of-concept material, increasing the risk of opportunistic exploitation. The issue is tracked under VulDB identifier VDB-259631 and classified under CWE-434: Unrestricted Upload of File with Dangerous Type.

Critical Impact

Remote attackers can upload arbitrary files, including server-side scripts, via the unrestricted avatar parameter, enabling code execution on the hosting web server.

Affected Products

• Fast5 / SourceCodester Prison Management System 1.0
• /Admin/add-admin.php Avatar Handler component
• Deployments running the affected PHP application on any web server

Discovery Timeline

• 2024-04-08 - CVE-2024-3437 published to NVD
• 2025-02-10 - Last updated in NVD database

Technical Details for CVE-2024-3437

Vulnerability Analysis

The vulnerability stems from missing validation of the avatar parameter inside /Admin/add-admin.php. The application accepts file uploads without verifying file extension, MIME type, or content signature. An attacker can submit a PHP file disguised as an avatar image and have it stored within the web server's document root. Once written to disk, the file becomes accessible via HTTP, allowing the attacker to execute embedded code under the web server's privileges. Because the affected handler is reachable over the network and requires no credentials or user interaction, the attack surface is large. Public proof-of-concept material describing remote code execution against this endpoint is available in the GitHub PoC Repository.

Root Cause

The root cause is the absence of server-side input validation on the upload handler. The application trusts client-supplied filenames and content, writing them directly to a web-accessible directory. This pattern aligns with CWE-434, unrestricted file upload of dangerous file types.

Attack Vector

An unauthenticated attacker issues a crafted HTTP POST request to /Admin/add-admin.php containing a malicious file in the avatar field. The server stores the file, and the attacker then requests the uploaded path to trigger code execution. No prior access, credentials, or social engineering are required. Further technical details are documented in the VulDB entry #259631.

No verified exploitation code is reproduced here. Refer to the linked PoC repository for the published technical walkthrough.

Detection Methods for CVE-2024-3437

Indicators of Compromise

• New files with executable extensions (.php, .phtml, .phar) inside avatar or upload directories of the Prison Management System.
• HTTP POST requests to /Admin/add-admin.php originating from unauthenticated sessions or unfamiliar source IP addresses.
• Unexpected outbound network connections initiated by the web server process shortly after avatar uploads.
• Modified or new administrator accounts created without corresponding legitimate workflow.

Detection Strategies

• Inspect web server access logs for POST requests to /Admin/add-admin.php followed by GET requests retrieving files from upload directories.
• Apply file integrity monitoring to upload directories and alert on creation of script-capable file types.
• Deploy web application firewall rules that block multipart uploads containing PHP tags or executable MIME signatures.

Monitoring Recommendations

• Forward web server, application, and host telemetry into a centralized analytics platform for correlated review.
• Monitor process lineage on the web server for child processes spawned by the PHP interpreter, such as shells or network utilities.
• Alert on outbound connections from web server processes to unusual destinations, which often indicate reverse shells.

How to Mitigate CVE-2024-3437

Immediate Actions Required

• Restrict access to /Admin/add-admin.php using IP allowlists or authentication enforcement at the reverse proxy until a patch is available.
• Remove execution permissions on the upload directory and configure the web server to refuse script execution in that path.
• Audit existing upload directories for unauthorized files and remove any that are not legitimate avatar images.

Patch Information

No official vendor patch is referenced in the advisory at the time of publication. Operators should track the VulDB entry #259631 for vendor updates and consider replacing the affected application if vendor support is unavailable.

Workarounds

• Enforce server-side validation that accepts only image MIME types and verified magic bytes for the avatar parameter.
• Rename uploaded files to randomized identifiers and strip user-supplied extensions before writing to disk.
• Store uploads outside the web root and serve them through a controlled handler that sets a non-executable content type.
• Disable the PHP handler within the upload directory using web server configuration directives.

# Apache configuration example to block script execution in uploads
<Directory "/var/www/prison_management/uploads">
    php_admin_flag engine off
    AddType text/plain .php .phtml .phar
    <FilesMatch "\.(php|phtml|phar)$">
        Require all denied
    </FilesMatch>
</Directory>