CVE-2024-6116: Simple Hotel Reservation System RCE Flaw

CVE-2024-6116 Overview

A critical unrestricted file upload vulnerability has been identified in itsourcecode Simple Online Hotel Reservation System version 1.0. The vulnerability exists in the edit_room.php file, where improper validation of the photo argument allows attackers to upload arbitrary files to the server. This flaw can be exploited remotely without authentication, potentially leading to remote code execution if an attacker uploads and executes malicious scripts on the vulnerable server.

Critical Impact
Remote attackers can upload malicious files including web shells to achieve remote code execution on affected servers without authentication.

Affected Products

Simple Online Hotel Reservation System 1.0
clive_21 simple_online_hotel_reservation_system

Discovery Timeline

2024-06-18 - CVE-2024-6116 published to NVD
2026-02-18 - Last updated in NVD database

Technical Details for CVE-2024-6116

Vulnerability Analysis

This vulnerability is classified as CWE-434: Unrestricted Upload of File with Dangerous Type. The edit_room.php endpoint fails to properly validate uploaded files through the photo parameter, allowing attackers to bypass expected file type restrictions. Without proper server-side validation of file extensions, MIME types, or file content, malicious actors can upload executable scripts (such as PHP web shells) that the server may then execute when accessed directly.

The network-accessible nature of this vulnerability means attackers can exploit it remotely. The low complexity of the attack, combined with no required privileges or user interaction, makes this vulnerability particularly dangerous for exposed hotel reservation systems.

Root Cause

The root cause is the absence of proper file validation mechanisms in the edit_room.php file when processing the photo argument. The application fails to:

Validate file extensions against a whitelist of allowed image types
Verify MIME types match expected image formats
Check file content/magic bytes to confirm the uploaded file is actually an image
Sanitize or rename uploaded files to prevent execution

Attack Vector

The attack can be launched remotely over the network against the vulnerable edit_room.php endpoint. An attacker would craft a malicious HTTP request containing a dangerous file (such as a PHP web shell) disguised or directly uploaded as a photo. Once uploaded, the attacker can navigate to the uploaded file's location on the server to execute the malicious code, potentially gaining full control of the web server.

The attack does not require any authentication or user interaction, and the technical complexity is low. Attackers can leverage this vulnerability to:

Upload web shells for persistent remote access
Execute arbitrary system commands
Exfiltrate sensitive data including guest information and payment details
Pivot to internal network resources
Deface the website or deploy ransomware

Detection Methods for CVE-2024-6116

Indicators of Compromise

Unusual file uploads in the hotel reservation system's upload directories with suspicious extensions (e.g., .php, .phtml, .php5)
Web server access logs showing requests to newly uploaded files in image directories
Unexpected outbound network connections from the web server
Modified or new PHP files in upload directories that contain obfuscated code

Detection Strategies

Monitor file upload activities for non-image file extensions or MIME type mismatches
Implement web application firewall (WAF) rules to detect malicious file upload attempts
Review access logs for POST requests to edit_room.php followed by GET requests to uploaded files
Deploy file integrity monitoring on upload directories to detect unauthorized file additions

Monitoring Recommendations

Enable detailed logging for the web application, particularly for file upload operations
Set up alerts for new executable files appearing in web-accessible upload directories
Monitor for anomalous process spawning from web server processes (e.g., www-data spawning shell commands)
Implement real-time scanning of uploaded files using antivirus or endpoint detection solutions

How to Mitigate CVE-2024-6116

Immediate Actions Required

Remove or disable public access to the edit_room.php file until a patch is available
Implement authentication requirements for all file upload functionality
Review and remove any suspicious files from upload directories
Consider taking the application offline if it is exposed to the internet and contains sensitive data

Patch Information

No official vendor patch has been released for this vulnerability at the time of this publication. System administrators should monitor the VulDB entry and the GitHub CVE Issue Report for updates regarding fixes or vendor responses.

Workarounds

Implement server-side file validation that checks file extensions against a strict whitelist (e.g., .jpg, .jpeg, .png, .gif only)
Validate uploaded file MIME types and magic bytes to ensure they match expected image formats
Store uploaded files outside the web root or in a directory with disabled script execution
Rename uploaded files to random strings and store original filenames in a database
Configure the web server to prevent execution of scripts in upload directories (e.g., using .htaccess rules for Apache)

bash

# Apache configuration to disable PHP execution in uploads directory
# Add to .htaccess in the uploads folder
<Directory /var/www/html/uploads>
    php_admin_flag engine off
    AddHandler default-handler .php .phtml .php3 .php4 .php5
</Directory>

# Alternatively, for nginx, add to server block:
# location ~* /uploads/.*\.php$ {
#     deny all;
# }