CVE-2024-4349: Pisay E-Learning System RCE Vulnerability

CVE-2024-4349 Overview

CVE-2024-4349 is an unrestricted file upload vulnerability in SourceCodester Pisay Online E-Learning System 1.0. The flaw resides in the /lesson/controller.php script, where the file parameter is processed without proper validation. Remote attackers can manipulate this parameter to upload arbitrary files to the web server. The exploit details have been publicly disclosed, increasing the likelihood of opportunistic abuse against exposed installations. The vulnerability is tracked under VulDB identifier VDB-262489 and is associated with [CWE-434: Unrestricted Upload of File with Dangerous Type].

Critical Impact
Remote attackers can upload arbitrary files through /lesson/controller.php without authentication, enabling potential webshell deployment and remote code execution on the underlying server.

Affected Products

Donbermoy Pisay Online E-Learning System 1.0
SourceCodester distribution of Pisay Online E-Learning System
Deployments using cpe:2.3:a:donbermoy:pisay_online_e-learning_system:1.0

Discovery Timeline

2024-04-30 - CVE-2024-4349 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-4349

Vulnerability Analysis

The vulnerability stems from improper validation of file uploads handled by /lesson/controller.php. The application accepts a file argument from the client and processes it without enforcing extension allowlists, MIME-type verification, or content inspection. Attackers can submit executable server-side scripts such as PHP files and have them stored within the web root. Once uploaded, the attacker requests the file directly through the web server to trigger execution under the privileges of the PHP process.

Root Cause

The root cause is the absence of server-side input validation on the file parameter in the controller logic. The application trusts the supplied filename, extension, and content type rather than enforcing a strict allowlist of permitted file types. Authentication and authorization checks are also missing on the upload endpoint, allowing unauthenticated network access. This combination maps directly to [CWE-434], unrestricted upload of file with dangerous type.

Attack Vector

Exploitation requires only network access to the application's HTTP interface. An attacker crafts a multipart upload request to /lesson/controller.php containing a malicious PHP file in the file parameter. After the server stores the file in a web-accessible directory, the attacker issues a follow-up HTTP request to execute the payload. Because no privileges or user interaction are required, the attack can be automated and launched at scale. The current EPSS score is 1.035% with a percentile of 59.4, reflecting moderate predicted exploitation activity.

No verified proof-of-concept code is available in the referenced sources. Refer to the GitHub Issue Discussion and VulDB #262489 for additional technical context.

Detection Methods for CVE-2024-4349

Indicators of Compromise

HTTP POST requests to /lesson/controller.php containing multipart form data with executable extensions such as .php, .phtml, .phar, or .jsp.
Newly created files in lesson upload directories that were not produced by legitimate administrative activity.
Outbound network connections initiated by the PHP worker process following upload activity, indicating webshell interaction.
Web access log entries showing direct GET requests to attacker-controlled filenames in upload paths.

Detection Strategies

Inspect web server access logs for POST requests targeting /lesson/controller.php with anomalous Content-Type boundaries or non-standard file extensions.
Deploy file integrity monitoring on the application's upload directories to alert on creation of script files.
Configure web application firewall rules to flag uploads where filename or magic bytes do not match an approved allowlist.

Monitoring Recommendations

Forward web server, PHP-FPM, and operating system logs to a centralized analytics platform for correlation.
Alert on PHP processes spawning shells (sh, bash, cmd.exe) or networking utilities such as curl, wget, or nc.
Monitor for unexpected modifications to the web root and review newly written files daily.

How to Mitigate CVE-2024-4349

Immediate Actions Required

Restrict network exposure of Pisay Online E-Learning System 1.0 to trusted networks or take affected instances offline until remediated.
Audit upload directories for unknown script files and remove any unauthorized artifacts.
Apply web server configuration to deny script execution within user-writable upload paths.
Rotate credentials and review the host for signs of lateral movement if any unauthorized file is found.

Patch Information

No vendor patch is referenced in the available advisories. SourceCodester and the upstream maintainer donbermoy have not published a fix for version 1.0 in the NVD or VulDB references. Operators should treat the application as unmaintained and plan migration to a supported learning management system.

Workarounds

Place the application behind a reverse proxy or web application firewall that enforces an extension allowlist on uploads to /lesson/controller.php.
Configure the web server to refuse execution of PHP within upload directories using directives such as Apache php_admin_flag engine off or equivalent Nginx location rules.
Add server-side authentication checks in front of the controller and disable anonymous access.
Implement file content inspection that validates magic bytes and rejects files containing PHP tags or other server-executable syntax.

bash

# Example Apache configuration to block script execution in uploads
<Directory "/var/www/pisay/lesson/uploads">
    php_admin_flag engine off
    AddType text/plain .php .phtml .phar .pl .py .jsp .asp .sh .cgi
    Options -ExecCGI
    <FilesMatch "\.(php|phtml|phar|pl|py|jsp|asp|sh|cgi)$">
        Require all denied
    </FilesMatch>
</Directory>