CVE-2024-5145: Vehicle Management System RCE Vulnerability

CVE-2024-5145 Overview

CVE-2024-5145 affects the SourceCodester Vehicle Management System version 1.0 developed by Warrendaloyan. The vulnerability resides in the /newdriver.php component, which handles HTTP POST requests for driver record creation. Attackers can manipulate the file parameter to bypass upload restrictions and place arbitrary files on the server. The flaw is categorized under [CWE-434] Unrestricted Upload of File with Dangerous Type. The exploit has been publicly disclosed, increasing the risk of opportunistic attacks against exposed instances. VulDB tracks this issue under identifier VDB-265289.

Critical Impact
Authenticated remote attackers can upload arbitrary files through /newdriver.php, enabling web shell deployment and potential server compromise.

Affected Products

Warrendaloyan Vehicle Management System 1.0
SourceCodester Vehicle Management System (all releases up to 1.0)
Deployments exposing /newdriver.php over HTTP or HTTPS

Discovery Timeline

2024-05-20 - CVE-2024-5145 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-5145

Vulnerability Analysis

The vulnerability is an unrestricted file upload flaw in the Vehicle Management System's driver registration workflow. The /newdriver.php endpoint accepts a file parameter through an HTTP POST request without validating the uploaded content's type, extension, or MIME header. An attacker with low-privilege access to the application can submit executable server-side scripts, including PHP files, and store them within the web root.

Once uploaded, the file becomes reachable through a direct URL request. Requesting the uploaded resource causes the PHP interpreter to execute it, granting the attacker code execution in the context of the web server process. From that foothold, attackers can pivot to database credentials stored in the application configuration, read arbitrary files, or establish persistence.

Root Cause

The root cause is missing server-side validation of file uploads within /newdriver.php. The handler trusts the client-supplied filename and content, failing to enforce a whitelist of permitted extensions, verify magic bytes, or store uploads outside the executable web root. This pattern maps directly to [CWE-434].

Attack Vector

Attack traffic reaches the target over the network. The attacker authenticates or reuses an existing low-privilege session, then issues a multipart POST request to /newdriver.php carrying a malicious PHP payload in the file field. The server writes the file to a predictable directory, after which the attacker requests the file to trigger execution.

The vulnerability mechanism is documented in the GitHub Issue Discussion and the VulDB #265289 entry. No verified proof-of-concept code is republished here.

Detection Methods for CVE-2024-5145

Indicators of Compromise

POST requests to /newdriver.php containing multipart form data with .php, .phtml, .phar, or double-extension filenames
New or unexpected script files appearing in the Vehicle Management System upload directories
Outbound network connections initiated by the web server process to unfamiliar hosts following upload activity
Web access logs showing GET requests to newly created files under upload paths shortly after a POST to /newdriver.php

Detection Strategies

Inspect web server logs for POST requests to /newdriver.php originating from external IP ranges
Deploy file integrity monitoring on the application's upload directories to alert on new executable content
Configure the web application firewall to block multipart uploads containing server-side script extensions
Correlate authentication events with subsequent file upload activity to identify abuse of low-privilege accounts

Monitoring Recommendations

Enable verbose HTTP logging on any host running the Vehicle Management System and forward logs to a centralized platform
Alert on PHP process spawns that originate from files located under user-writable upload directories
Baseline normal upload volumes and flag sudden spikes tied to the /newdriver.php endpoint

How to Mitigate CVE-2024-5145

Immediate Actions Required

Restrict network access to the Vehicle Management System until a patched build is available
Disable or remove the /newdriver.php endpoint if the driver registration function is not required
Revoke and rotate any credentials or session tokens that could have interacted with the affected server
Review upload directories for unauthorized files and remove any suspicious PHP scripts

Patch Information

No vendor patch has been published for the Warrendaloyan Vehicle Management System at the time of this writing. Consult the VulDB CTI ID #265289 record and the GitHub Issue Discussion for the latest remediation status.

Workarounds

Place the application behind an authenticating reverse proxy and permit access only from trusted management networks
Configure the web server to deny PHP execution within upload directories using explicit handler mappings
Enforce server-side validation of file extensions and MIME types before persisting uploads
Store uploaded files outside the web root and serve them through a controlled download handler

bash

# Example Apache configuration to prevent PHP execution in upload directories
<Directory "/var/www/vehicle_management_system/uploads">
    php_admin_flag engine off
    RemoveHandler .php .phtml .phar
    RemoveType .php .phtml .phar
    <FilesMatch "\.(php|phtml|phar)$">
        Require all denied
    </FilesMatch>
</Directory>