CVE-2024-4820: Online Computer Store RCE Vulnerability

CVE-2024-4820 Overview

CVE-2024-4820 is an unrestricted file upload vulnerability in SourceCodester Online Computer and Laptop Store 1.0, developed by oretnom23. The flaw resides in the /classes/SystemSettings.php?f=update_settings endpoint, which accepts uploaded files without validating type, extension, or content [CWE-434]. Remote authenticated attackers can abuse this endpoint to place arbitrary files on the web server, including executable scripts. The exploit details have been publicly disclosed and are tracked as VulDB entry 263941.

Critical Impact

Attackers with low-privilege access can upload web shells through SystemSettings.php, enabling remote code execution and full compromise of the application.

Affected Products

• Oretnom23 Online Computer and Laptop Store 1.0
• SourceCodester Online Computer and Laptop Store (all 1.0 builds)
• Deployments exposing /classes/SystemSettings.php over HTTP or HTTPS

Discovery Timeline

• 2024-05-14 - CVE-2024-4820 published to NVD
• 2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-4820

Vulnerability Analysis

The vulnerability is an unrestricted file upload flaw classified under [CWE-434]. The update_settings function inside /classes/SystemSettings.php handles administrative configuration updates, including file uploads for site branding assets. The handler writes uploaded content to a web-accessible directory without enforcing an allow-list of extensions or MIME types.

An attacker with access to the settings interface can submit a crafted multipart request containing a PHP file. The server stores the file inside the web root, where the PHP interpreter executes it on request. This grants the attacker command execution under the web server user account.

The EPSS score of 1.089% (62.6 percentile) reflects public exploit availability and low technical barriers to abuse. Because the upload endpoint accepts remote requests, attackers do not require local access to weaponize the flaw.

Root Cause

The root cause is missing server-side validation of uploaded file metadata and content. The update_settings handler trusts the client-supplied filename and does not restrict destination paths or executable extensions. No content inspection confirms the file is a legitimate image or configuration asset before it is written to disk.

Attack Vector

The attack vector is network-based and requires low authentication privileges. An attacker submits a POST request to /classes/SystemSettings.php?f=update_settings containing a malicious PHP file inside a multipart form field. Once written to a web-accessible path, the attacker requests the uploaded file directly to trigger execution.

A public proof of concept describes the upload procedure. See the GitHub PoC Repository and the VulDB CVE Analysis for the full request structure and reproduction steps.

Detection Methods for CVE-2024-4820

Indicators of Compromise

• POST requests to /classes/SystemSettings.php?f=update_settings containing multipart file fields with .php, .phtml, .phar, or double-extension filenames.
• Newly created PHP files inside upload directories owned by the web server user with recent modification times.
• Outbound connections from the web server process to unknown IP addresses shortly after settings updates.
• HTTP GET requests directly targeting files inside /uploads/ or asset directories with executable extensions.

Detection Strategies

• Alert on file creation events in web root subdirectories where the file extension is executable by PHP.
• Correlate authenticated administrative sessions with subsequent uploads and immediate GET requests to the new file.
• Inspect web server access logs for the f=update_settings parameter followed by anomalous request patterns.

Monitoring Recommendations

• Enable web application firewall (WAF) rules that block executable MIME types on upload endpoints.
• Forward web server and PHP-FPM logs to a centralized SIEM for query and retention.
• Monitor process ancestry for PHP interpreters spawning shells, curl, wget, or reverse-connection utilities.

How to Mitigate CVE-2024-4820

Immediate Actions Required

• Restrict network access to /classes/SystemSettings.php to trusted administrator IP ranges until a fix is applied.
• Audit the application upload directory for unauthorized PHP or script files and remove any unknown artifacts.
• Rotate administrative credentials and session tokens if evidence of exploitation is found.
• Disable PHP execution inside upload directories using web server configuration directives.

Patch Information

No official vendor advisory or patch has been published for SourceCodester Online Computer and Laptop Store 1.0. Operators should treat the application as vulnerable and apply compensating controls. Track vendor updates through the VulDB #263941 reference and the VulDB Submission record.

Workarounds

• Add server-side validation to update_settings that enforces an allow-list of image extensions and inspects file magic bytes.
• Rename uploaded files to server-generated identifiers and store them outside the web root.
• Configure Apache or Nginx to deny execution of .php files inside asset directories using php_admin_flag engine off or equivalent location blocks.
• Deploy a reverse proxy or WAF rule set that blocks multipart uploads containing executable content on the settings endpoint.

# Apache configuration example to prevent PHP execution in upload directories
<Directory "/var/www/online_store/uploads">
    php_admin_flag engine off
    <FilesMatch "\.(php|phtml|phar|php5|php7)$">
        Require all denied
    </FilesMatch>
</Directory>