CVE-2024-5745: Bakery Online Ordering System RCE Flaw

CVE-2024-5745 Overview

A critical unrestricted file upload vulnerability has been identified in itsourcecode Bakery Online Ordering System version 1.0. The vulnerability exists in the file /admin/modules/product/controller.php?action=add where improper validation of the image parameter allows attackers to upload arbitrary files to the server. This weakness (CWE-434: Unrestricted Upload of File with Dangerous Type) can be exploited remotely without authentication, potentially enabling attackers to upload malicious web shells or executable files that lead to remote code execution.

Critical Impact

Attackers can remotely upload arbitrary files including web shells, potentially gaining complete control over the web server and underlying system.

Affected Products

• Bakery Online Ordering System 1.0
• itsourcecode Bakery Online Ordering System

Discovery Timeline

• 2024-06-07 - CVE-2024-5745 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2024-5745

Vulnerability Analysis

This vulnerability falls under CWE-434 (Unrestricted Upload of File with Dangerous Type), which occurs when the application fails to properly validate uploaded files. The vulnerable endpoint at /admin/modules/product/controller.php?action=add accepts file uploads through the image parameter without implementing adequate security controls to verify the file type, content, or extension.

When processing product image uploads, the application does not enforce restrictions on file types, allowing an attacker to upload files with dangerous extensions such as .php, .phtml, or other executable formats. Once uploaded, these files may be accessible via a predictable URL path, enabling the attacker to execute arbitrary code on the server.

The network-accessible nature of this vulnerability makes it particularly dangerous, as it can be exploited remotely without requiring any authentication or user interaction.

Root Cause

The root cause of this vulnerability is the lack of proper file validation in the product upload functionality. The application fails to implement essential security controls including:

1. File extension validation against a whitelist of allowed image types
2. MIME type verification to ensure uploaded content matches expected image formats
3. Content inspection to detect malicious payloads embedded within uploaded files
4. Randomization of uploaded file names and storage locations

Attack Vector

The attack can be executed remotely over the network. An attacker can craft a malicious HTTP POST request to the vulnerable endpoint, including a PHP web shell or similar malicious payload disguised as an image file. The exploitation flow typically involves:

1. The attacker identifies the vulnerable file upload endpoint at /admin/modules/product/controller.php?action=add
2. A malicious PHP file containing web shell code is prepared
3. The attacker submits the malicious file through the image parameter
4. The server accepts and stores the file without proper validation
5. The attacker accesses the uploaded file via a predictable URL to execute arbitrary commands

Technical details and proof-of-concept information are documented in the GitHub CVE Analysis and the VulDB CTI Report #267414.

Detection Methods for CVE-2024-5745

Indicators of Compromise

• Unexpected PHP, PHTML, or other executable files appearing in product image upload directories
• Web server logs showing POST requests to /admin/modules/product/controller.php?action=add followed by requests to unusual file paths
• Presence of web shell artifacts such as files with obfuscated PHP code or command execution functions like system(), exec(), or passthru()

Detection Strategies

• Monitor file system changes in upload directories for non-image file types
• Implement web application firewall (WAF) rules to detect malicious file upload attempts
• Analyze HTTP traffic for POST requests containing suspicious file extensions or PHP code signatures
• Review server access logs for sequential patterns of file upload followed by direct file access

Monitoring Recommendations

• Enable file integrity monitoring on web application directories to detect unauthorized file modifications
• Configure alerts for new executable files created in upload or temporary directories
• Implement logging for all file upload operations including file names, types, and source IP addresses
• Deploy endpoint detection and response (EDR) solutions to monitor for web shell execution patterns

How to Mitigate CVE-2024-5745

Immediate Actions Required

• Remove or disable the vulnerable file upload functionality until a patch is available
• Implement strict file extension whitelisting allowing only legitimate image formats (.jpg, .jpeg, .png, .gif)
• Configure the web server to prevent execution of PHP scripts in upload directories
• Review upload directories for any suspicious files and remove them immediately

Patch Information

No official vendor patch has been released at the time of this writing. Organizations using Bakery Online Ordering System 1.0 should contact itsourcecode for remediation guidance. Additional vulnerability details are available at VulDB #267414.

Workarounds

• Disable the product upload functionality or restrict access to trusted administrators only
• Implement server-side file type validation using both extension checking and MIME type verification
• Store uploaded files outside the web root to prevent direct execution
• Configure .htaccess or web server settings to deny PHP execution in upload directories
• Apply input sanitization to rename uploaded files with random names and force image extensions

# Apache configuration to prevent PHP execution in upload directory
# Add to .htaccess in the uploads folder
<FilesMatch "\.php$">
    Deny from all
</FilesMatch>

# Alternative: Disable PHP engine entirely
php_flag engine off