CVE-2024-7904: Dedebiz Dedebiz RCE Vulnerability

CVE-2024-7904 Overview

CVE-2024-7904 is an unrestricted file upload vulnerability in DedeBIZ 6.3.0, a PHP-based content management system. The flaw resides in the admin/file_manage_control.php script within the File Extension Handler component. Attackers can manipulate the upfile1 parameter to upload arbitrary files, bypassing extension restrictions [CWE-434]. The attack requires network access and low-privileged authentication but no user interaction. Public exploit details have been disclosed, increasing exposure for unpatched instances. The vendor was contacted before public disclosure but did not respond.

Critical Impact
Authenticated remote attackers can upload malicious files to the DedeBIZ web server, enabling potential webshell deployment and follow-on remote code execution.

Affected Products

DedeBIZ 6.3.0
Component: admin/file_manage_control.php (File Extension Handler)
Parameter: upfile1

Discovery Timeline

2024-08-18 - CVE-2024-7904 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-7904

Vulnerability Analysis

The vulnerability is classified as an Unrestricted Upload of File with Dangerous Type [CWE-434]. The admin/file_manage_control.php script accepts file uploads through the upfile1 parameter without adequately validating the file extension or MIME type. This gap allows an attacker with administrative panel access to write executable PHP files into web-accessible directories. Because DedeBIZ processes uploaded content server-side, a successfully uploaded webshell can be invoked directly via HTTP to execute arbitrary commands under the web server user.

Root Cause

The root cause is missing or insufficient allow-list validation in the File Extension Handler. The upload routine trusts client-supplied filename data and does not enforce a restrictive server-side check against dangerous extensions such as .php, .phtml, or .php5. Combined with a predictable upload path, this enables attackers to place executable code into a location the PHP interpreter will process.

Attack Vector

Exploitation requires network access to the DedeBIZ administrative interface and low-privileged credentials. An attacker submits a crafted multipart HTTP POST request to admin/file_manage_control.php with the upfile1 field containing a file whose extension bypasses the handler's checks. Once the file is written to a served directory, the attacker requests the uploaded path to trigger execution. Public disclosure of the exploit details on VulDB and GitHub lowers the barrier to exploitation. See the VulDB entry #275030 and the GitHub CVE-2024-7904 write-up for technical specifics.

Detection Methods for CVE-2024-7904

Indicators of Compromise

Unexpected .php, .phtml, or double-extension files appearing under DedeBIZ upload or admin directories.
POST requests to admin/file_manage_control.php containing the upfile1 parameter from unusual source IPs.
Web server processes (php-fpm, httpd, nginx) spawning shells, curl, wget, or reconnaissance commands.
New administrator sessions preceding file upload activity in DedeBIZ access logs.

Detection Strategies

Inspect web server access logs for POSTs to file_manage_control.php and correlate with subsequent GET requests to newly created files.
Monitor the DedeBIZ web root for creation of executable script files outside of expected update windows.
Deploy behavioral endpoint monitoring on the web server host to flag anomalous child processes spawned by the PHP interpreter.

Monitoring Recommendations

Enable file integrity monitoring (FIM) on DedeBIZ upload and admin directories.
Forward web and PHP error logs to a centralized SIEM for correlation and long-term retention.
Alert on outbound network connections initiated by the web server process to non-approved destinations.

How to Mitigate CVE-2024-7904

Immediate Actions Required

Restrict access to admin/file_manage_control.php to trusted management IP addresses via web server ACLs or a WAF rule.
Rotate administrator credentials and audit existing admin accounts for unauthorized additions.
Review the DedeBIZ web root for unexpected script files and remove any that cannot be attributed to legitimate changes.

Patch Information

No vendor patch is available. The vendor was contacted about this disclosure but did not respond. Operators should treat DedeBIZ 6.3.0 as unpatched and apply compensating controls until a fix is released. Track updates through the VulDB CTI entry.

Workarounds

Configure the web server to deny execution of PHP files within upload directories using php_flag engine off or equivalent location blocks.
Deploy a WAF rule that inspects multipart uploads to file_manage_control.php and blocks requests where upfile1 contains dangerous extensions.
Enforce a server-side allow-list of permitted MIME types and extensions if custom patching is feasible.
Consider migrating off DedeBIZ 6.3.0 to a maintained CMS platform if vendor support remains unresponsive.

bash

# Example nginx configuration to block PHP execution in DedeBIZ upload paths
location ~* ^/(uploads|data)/.*\.(php|phtml|php5|phar)$ {
    deny all;
    return 403;
}

# Restrict admin panel access to a management CIDR
location ^~ /admin/ {
    allow 203.0.113.0/24;
    deny all;
}