CVE-2024-4966: Sinamjackson Schoolwebtech RCE Vulnerability

CVE-2024-4966 Overview

CVE-2024-4966 is an unrestricted file upload vulnerability in SourceCodester SchoolWebTech 1.0. The flaw resides in an unspecified function within /improve/home.php, where the image parameter accepts attacker-controlled file uploads without validation. An unauthenticated remote attacker can submit a request to upload arbitrary files, potentially including server-side scripts. The vulnerability is tracked under CWE-434 (Unrestricted Upload of File with Dangerous Type) and has been publicly disclosed under VulDB identifier 264534.

Critical Impact
Remote attackers can upload arbitrary files through the image parameter in /improve/home.php without authentication, with public disclosure increasing exposure risk.

Affected Products

SourceCodester SchoolWebTech 1.0
Vendor: sinamjackson
CPE: cpe:2.3:a:sinamjackson:schoolwebtech:1.0

Discovery Timeline

2024-05-16 - CVE-2024-4966 published to NVD
2025-02-10 - Last updated in NVD database

Technical Details for CVE-2024-4966

Vulnerability Analysis

The vulnerability exists in the file upload handler located at /improve/home.php within SchoolWebTech 1.0. The application processes the image request parameter without enforcing restrictions on file type, extension, content type, or MIME validation. This classifies the issue as an Unrestricted File Upload weakness under CWE-434.

Because the upload endpoint is reachable over the network and requires no authentication or user interaction, an attacker can deliver a crafted multipart request directly to the vulnerable handler. The application accepts the file and stores it in a location reachable by the web server. If the uploaded file contains executable PHP code and lands in a directory served by the PHP interpreter, the attacker can then request the file to achieve code execution under the privileges of the web server process.

The exploit details have been publicly disclosed through VulDB and a GitHub issue tracker, lowering the technical barrier for opportunistic exploitation.

Root Cause

The root cause is the absence of server-side input validation on the image parameter. The application does not enforce allow-listing for file extensions, does not verify MIME types, and does not rename or sandbox uploaded content. Combined with a publicly reachable upload path, this design enables direct delivery of attacker-controlled files.

Attack Vector

Attackers issue an HTTP POST request to /improve/home.php containing a multipart form field named image. The payload can be a PHP web shell or other executable script. After upload, the attacker retrieves the file via its predictable URL to trigger execution. No credentials or user interaction are required.

No verified exploitation code is published in vetted exploit repositories at this time. See the VulDB advisory #264534 for additional technical context.

Detection Methods for CVE-2024-4966

Indicators of Compromise

Unexpected files with executable extensions (.php, .phtml, .phar) created within the SchoolWebTech /improve/ directory tree
HTTP POST requests to /improve/home.php containing multipart form data with the image field from external sources
Web server access logs showing GET requests to recently uploaded files in upload directories
Outbound network connections initiated by the web server process to unfamiliar hosts following file upload activity

Detection Strategies

Inspect web server and WAF logs for POST requests to /improve/home.php with non-image file contents in the image parameter
Monitor the web root for file creation events involving server-executable extensions using file integrity monitoring tools
Correlate upload events with subsequent shell-like process activity (sh, bash, cmd.exe) spawned by the PHP runtime

Monitoring Recommendations

Enable verbose logging on the PHP-FPM or Apache worker to capture script execution paths under the SchoolWebTech application
Configure alerts for any newly written file in upload directories that is subsequently requested via HTTP
Track anomalous user-agents and source IPs targeting /improve/home.php and apply rate limiting

How to Mitigate CVE-2024-4966

Immediate Actions Required

Restrict network access to the SchoolWebTech application using firewall rules or an authentication-enforcing reverse proxy until a fix is available
Disable PHP execution in any directory that receives user-uploaded content via web server configuration
Remove or rename /improve/home.php if the upload functionality is not required for production operation
Audit upload directories for unauthorized files and remove any web shells or unknown scripts

Patch Information

No vendor patch has been published for SourceCodester SchoolWebTech 1.0 at the time of this writing. Organizations running this application should treat it as unmaintained and consider migration to a supported alternative. Refer to the VulDB submission record and the GitHub issue discussion for ongoing updates.

Workarounds

Implement a web application firewall rule blocking POST requests to /improve/home.php that contain non-image MIME types in the image field
Enforce server-side allow-listing of file extensions and validate magic bytes for any required upload feature
Store uploaded files outside the web root and serve them through a download handler that prevents script interpretation
Apply least-privilege file system permissions to the web server process to limit post-upload impact

bash

# Example Apache configuration disabling PHP execution in upload directories
<Directory "/var/www/schoolwebtech/improve/uploads">
    php_admin_flag engine off
    <FilesMatch "\.(php|phtml|phar|php3|php4|php5|php7)$">
        Require all denied
    </FilesMatch>
    Options -ExecCGI
    AddType text/plain .php .phtml .phar
</Directory>