CVE-2024-6115: Simple Online Hotel Reservation RCE Flaw

CVE-2024-6115 Overview

A critical unrestricted file upload vulnerability has been identified in itsourcecode Simple Online Hotel Reservation System version 1.0. This vulnerability exists within the add_room.php file, where improper validation of the photo parameter allows attackers to upload arbitrary files to the server. The vulnerability can be exploited remotely without authentication, potentially enabling attackers to upload malicious scripts that could lead to remote code execution on the affected web server.

Critical Impact

Remote attackers can exploit this unrestricted file upload vulnerability to upload malicious PHP scripts or web shells, potentially gaining complete control over the web server and underlying systems.

Affected Products

• Simple Online Hotel Reservation System 1.0 by itsourcecode/clive_21
• Web servers hosting the vulnerable add_room.php component
• Any deployment using the affected hotel reservation system without additional upload restrictions

Discovery Timeline

• 2024-06-18 - CVE-2024-6115 published to NVD
• 2026-02-18 - Last updated in NVD database

Technical Details for CVE-2024-6115

Vulnerability Analysis

This vulnerability stems from a fundamental security flaw in the file upload functionality of the Simple Online Hotel Reservation System. The add_room.php file accepts file uploads through the photo parameter without implementing proper security controls to validate the file type, content, or extension. This represents a classic CWE-434 (Unrestricted Upload of File with Dangerous Type) vulnerability.

The lack of input validation on uploaded files creates a direct pathway for attackers to upload executable scripts, such as PHP web shells, that can then be accessed and executed on the server. Since the attack vector is network-based and requires no authentication, any internet-exposed instance of this application is at risk.

Root Cause

The root cause of CVE-2024-6115 is the absence of file validation mechanisms in the upload handler within add_room.php. The application fails to implement essential security controls including:

• File extension whitelist validation to ensure only image files (e.g., .jpg, .png, .gif) are accepted
• MIME type verification to confirm the actual content type matches expected image formats
• File content inspection to detect embedded malicious code within seemingly valid files
• Filename sanitization to prevent directory traversal attacks through crafted filenames

Attack Vector

The attack can be launched remotely over the network by any unauthenticated attacker. The exploitation process involves submitting a crafted HTTP POST request to the add_room.php endpoint with a malicious file in the photo parameter. Since there are no authentication requirements and the attack complexity is low, successful exploitation is straightforward.

An attacker would typically upload a PHP web shell disguised with an image extension or directly as a .php file. Once uploaded, the attacker can navigate to the uploaded file's location on the web server to execute arbitrary commands. This could lead to complete server compromise, data theft, or lateral movement within the network.

The vulnerability has been publicly disclosed, and technical details are available through the GitHub CVE Issue and VulDB entry #268867.

Detection Methods for CVE-2024-6115

Indicators of Compromise

• Unexpected PHP files or executable scripts appearing in the upload directories associated with room photos
• Web server access logs showing POST requests to add_room.php followed by GET requests to unusual file paths
• Presence of web shells or backdoor scripts in publicly accessible directories
• Unusual outbound network connections originating from the web server process

Detection Strategies

• Monitor file system events in upload directories for creation of non-image files or files with executable extensions
• Implement web application firewall (WAF) rules to inspect multipart/form-data uploads for malicious content
• Review Apache/Nginx access logs for suspicious request patterns targeting add_room.php
• Deploy file integrity monitoring to detect unauthorized file modifications in web-accessible directories

Monitoring Recommendations

• Enable detailed logging for the web application and review logs regularly for anomalous upload activity
• Configure alerts for new PHP files created in upload or media directories
• Implement network monitoring to detect command and control traffic that may follow successful exploitation
• Regularly scan web directories for known web shell signatures and suspicious file patterns

How to Mitigate CVE-2024-6115

Immediate Actions Required

• Restrict access to add_room.php by implementing authentication and authorization controls
• Implement server-side file type validation using a strict whitelist of allowed image extensions
• Move the Simple Online Hotel Reservation System behind a VPN or restrict access to trusted IP ranges
• Consider taking the application offline until proper security controls can be implemented

Patch Information

At the time of publication, no official vendor patch has been released for this vulnerability. Organizations using Simple Online Hotel Reservation System 1.0 should implement the workarounds below and monitor for any updates from the vendor. For the latest vulnerability details, refer to the VulDB entry.

Workarounds

• Implement a whitelist-based file extension filter to only allow .jpg, .jpeg, .png, and .gif extensions
• Add MIME type validation to verify uploaded content matches expected image formats
• Configure the web server to prevent PHP execution in upload directories using .htaccess or server configuration
• Store uploaded files outside the web root and serve them through a controlled download script
• Implement rate limiting on the upload endpoint to slow potential automated exploitation attempts

# Apache .htaccess configuration to disable PHP execution in upload directory
# Place this file in the directory where room photos are uploaded

# Disable PHP execution
<FilesMatch "\.php$">
    Order Deny,Allow
    Deny from all
</FilesMatch>

# Only allow specific image types
<FilesMatch "\.(?!(jpg|jpeg|png|gif)$)">
    Order Allow,Deny
    Deny from all
</FilesMatch>