CVE-2024-4946: Online Art Gallery Management System RCE

CVE-2024-4946 Overview

CVE-2024-4946 is an unrestricted file upload vulnerability in SourceCodester Online Art Gallery Management System 1.0. The flaw resides in admin/adminHome.php and is triggered through manipulation of the sliderpic parameter. An authenticated attacker can upload arbitrary files remotely over the network, which can lead to further compromise of the hosting environment.

The vulnerability is classified under CWE-434: Unrestricted Upload of File with Dangerous Type. Public disclosure includes proof-of-concept discussion, increasing the likelihood of opportunistic exploitation against exposed installations.

Critical Impact
Authenticated attackers can upload arbitrary files to the web server through the sliderpic parameter, enabling potential web shell placement and remote command execution on the underlying host.

Affected Products

SourceCodester Online Art Gallery Management System 1.0
Donbermoy Online Art Gallery Management System (all deployments of version 1.0)
Web installations exposing admin/adminHome.php

Discovery Timeline

2024-05-16 - CVE-2024-4946 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-4946

Vulnerability Analysis

The vulnerability exists in the administrative interface of the Online Art Gallery Management System, specifically in the slider image handling logic of admin/adminHome.php. The application accepts file uploads through the sliderpic parameter without enforcing sufficient validation on file type, extension, or content.

An attacker who reaches the administrative upload path can submit files with server-executable extensions such as .php. Once written to a web-accessible directory, these files execute under the web server's privileges when requested. This transforms a file handling weakness into a code execution primitive on the host.

The attack requires network access to the application and low-privilege authentication to reach the admin functionality. No user interaction is needed to complete the upload once the request is issued.

Root Cause

The root cause is missing validation on user-supplied files in the sliderpic upload handler. The application does not restrict file extensions to expected image formats, does not verify MIME types against file contents, and does not rename or sandbox uploaded files. This aligns with the [CWE-434] classification for unrestricted upload of dangerous file types.

Attack Vector

The attack is delivered over HTTP or HTTPS against the administrative endpoint. An attacker submits a crafted multipart form POST to admin/adminHome.php containing a malicious payload in the sliderpic field. After the upload succeeds, the attacker requests the resulting file directly through the web root to trigger execution.

Refer to the GitHub Issue #29 Discussion and VulDB #264481 for public technical details describing the exploitation path.

Detection Methods for CVE-2024-4946

Indicators of Compromise

New files with executable extensions such as .php, .phtml, or .phar appearing in slider or upload directories used by the Online Art Gallery application.
HTTP POST requests to admin/adminHome.php containing the sliderpic parameter with non-image content types or unusual file names.
Web server access logs showing direct GET requests to newly created files under upload directories shortly after a POST to the admin page.

Detection Strategies

Monitor file integrity on the web root and upload directories, alerting on creation of server-executable files.
Inspect web application logs for POST requests to adminHome.php correlated with subsequent requests for uploaded files.
Deploy web application firewall rules that inspect multipart uploads for script content and disallowed extensions in the sliderpic field.

Monitoring Recommendations

Enable process auditing on the web server user account to identify child processes spawned by the PHP interpreter, which often indicates web shell activity.
Alert on outbound network connections initiated by the web server process, which can indicate post-exploitation command-and-control activity.
Retain access and error logs for the affected application to support forensic reconstruction if compromise is suspected.

How to Mitigate CVE-2024-4946

Immediate Actions Required

Restrict access to admin/adminHome.php to trusted administrative IP ranges using web server or firewall rules.
Remove or disable the Online Art Gallery Management System 1.0 from internet-facing infrastructure until validation controls are in place.
Audit existing upload directories for unauthorized files with executable extensions and remove any that are not expected.

Patch Information

No vendor patch is currently referenced for CVE-2024-4946. Operators of SourceCodester Online Art Gallery Management System 1.0 should treat the application as unmaintained and consider migrating to a supported alternative. Monitor the VulDB entry 264481 for any subsequent vendor updates.

Workarounds

Configure the web server to deny execution of scripts within upload directories, for example by disabling PHP handlers in those paths.
Enforce server-side validation that restricts uploads to allow-listed image MIME types and verifies file signatures against declared types.
Rename uploaded files to non-executable extensions and store them outside the web root, serving them through a controlled handler.
Require multi-factor authentication for the administrative interface to reduce the risk of credential-based abuse of the upload feature.

bash

# Example Apache configuration to block script execution in the uploads directory
<Directory "/var/www/html/online-art-gallery/admin/uploads">
    php_admin_flag engine off
    <FilesMatch "\.(php|phtml|phar|php5|php7)$">
        Require all denied
    </FilesMatch>
    Options -ExecCGI
    AddHandler cgi-script .none
</Directory>