CVE-2024-4923: Codezips E-commerce Site RCE Vulnerability

CVE-2024-4923 Overview

CVE-2024-4923 is an unrestricted file upload vulnerability in Codezips E-Commerce Site 1.0. The flaw resides in admin/addproduct.php, where the profilepic parameter accepts arbitrary file uploads without validation. Attackers can exploit this vulnerability remotely and public exploit details are available through VulDB identifier VDB-264460. The weakness maps to [CWE-434] Unrestricted Upload of File with Dangerous Type. Successful exploitation allows an authenticated user with low privileges to upload malicious files, potentially including web shells, into the application directory. This creates a pathway to remote code execution on the underlying web server hosting the e-commerce application.

Critical Impact
An authenticated attacker can upload arbitrary files through the product image upload feature, enabling potential web shell deployment and server compromise.

Affected Products

Codezips E-Commerce Site 1.0
admin/addproduct.php component
Deployments exposing the admin panel to untrusted networks

Discovery Timeline

2024-05-16 - CVE-2024-4923 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-4923

Vulnerability Analysis

The vulnerability exists in the product creation workflow of the Codezips E-Commerce Site 1.0 admin panel. The addproduct.php script accepts image uploads through the profilepic form parameter to associate images with product listings. The upload handler fails to validate file extensions, MIME types, or file content before writing the uploaded data to the server.

An attacker with access to the admin interface can substitute an executable script for the expected image file. Because the target path resides within the web root, the server will execute uploaded PHP files when requested through a browser. This behavior transforms a benign image upload feature into a code execution primitive.

The attack requires network access to the admin functionality and low-privilege authentication. No user interaction is needed beyond submitting the crafted upload request.

Root Cause

The root cause is missing input validation on file uploads, classified as [CWE-434]. The addproduct.php handler does not enforce an allow-list of permitted file extensions, verify magic bytes, or restrict the upload directory from script execution. Any file type submitted through the profilepic parameter is accepted and stored in a web-accessible location.

Attack Vector

The attack vector is network-based against the admin panel. An attacker with valid admin credentials, or one who has bypassed authentication through other means, submits a POST request to admin/addproduct.php with a malicious file attached to the profilepic field. After the upload succeeds, the attacker requests the uploaded file URL directly to trigger execution. See the GitHub CVE Issue Discussion for reproduction details.

The vulnerability mechanism involves substituting a PHP web shell for an image file during product creation. See the VulDB CTI Report #264460 for additional context on the exploitation path.

Detection Methods for CVE-2024-4923

Indicators of Compromise

Non-image files (.php, .phtml, .phar) present in product image upload directories
HTTP POST requests to admin/addproduct.php with profilepic parameter containing non-image Content-Type headers
Unexpected outbound network connections originating from the web server process following product creation activity
Web server access logs showing GET requests to uploaded files under image storage paths with script extensions

Detection Strategies

Monitor file creation events in web-accessible upload directories for files with executable extensions
Inspect HTTP request bodies to addproduct.php for magic bytes inconsistent with declared image MIME types
Correlate admin authentication events with subsequent file upload and execution activity across web server logs
Deploy web application firewall rules to reject uploads containing PHP tags or script content within image parameters

Monitoring Recommendations

Enable file integrity monitoring on the Codezips web root and all upload directories
Forward web server access and error logs to a centralized logging platform for retention and correlation
Alert on any process spawned by the web server user that executes shell commands or network utilities
Review admin panel access patterns weekly for anomalous session activity or unfamiliar source addresses

How to Mitigate CVE-2024-4923

Immediate Actions Required

Restrict access to admin/addproduct.php and the entire admin directory using network-level controls or .htaccess rules
Audit upload directories for unexpected script files and remove any unauthorized content immediately
Rotate all administrative credentials for the Codezips application and enforce strong password requirements
Disable PHP execution in upload directories through web server configuration

Patch Information

No official vendor patch is listed in the NVD advisory or referenced vendor resources for Codezips E-Commerce Site 1.0. Operators should treat the application as unpatched and apply compensating controls. Consult the VulDB Incident Report #264460 for any updated remediation guidance published after the CVE was assigned.

Workarounds

Configure the web server to serve upload directories as static content only, blocking .php and script execution via AddType or location directives
Implement a reverse proxy or web application firewall in front of the application to filter uploads by MIME type and file signature
Move upload storage outside the web root and serve files through a controlled script that validates content type
Replace the vulnerable version with an alternative e-commerce platform if the vendor does not release a fix

bash

# Apache configuration to disable PHP execution in upload directories
<Directory "/var/www/codezips/admin/uploads">
    php_flag engine off
    <FilesMatch "\.(php|phtml|phar|php3|php4|php5|php7)$">
        Require all denied
    </FilesMatch>
</Directory>

# Nginx equivalent
location ~* /admin/uploads/.*\.(php|phtml|phar)$ {
    deny all;
    return 403;
}