CVE-2024-7905: Dedebiz 6.3.0 RCE Vulnerability

CVE-2024-7905 Overview

CVE-2024-7905 is an unrestricted file upload vulnerability in DedeBIZ 6.3.0. The flaw resides in the AdminUpload function inside admin/archives_do.php. An authenticated attacker can manipulate the litpic parameter to upload arbitrary files to the server. The vulnerability is remotely exploitable over the network and has been publicly disclosed. The vendor was contacted before disclosure but did not respond. The weakness maps to [CWE-434] (Unrestricted Upload of File with Dangerous Type).

Critical Impact
Authenticated attackers can upload arbitrary files through the litpic parameter, enabling potential web shell deployment and follow-on code execution on the DedeBIZ host.

Affected Products

DedeBIZ 6.3.0
admin/archives_do.php — AdminUpload function
litpic request parameter handler

Discovery Timeline

2024-08-18 - CVE-2024-7905 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-7905

Vulnerability Analysis

DedeBIZ 6.3.0 exposes an administrative upload endpoint through admin/archives_do.php. The AdminUpload function processes the litpic argument without adequately validating the file type, extension, or content. An attacker with access to the administrative interface can submit a crafted request that places attacker-controlled files onto the web server file system. Because the affected endpoint sits inside the content management workflow, uploaded files may land in web-accessible directories. Successful exploitation can lead to server-side script execution, persistence, and lateral movement inside the hosting environment.

Root Cause

The root cause is missing or insufficient validation of uploaded file metadata and content in the AdminUpload handler. The application trusts the litpic argument and writes the associated file without enforcing allow-listed extensions or MIME types. This is a classic instance of [CWE-434].

Attack Vector

Exploitation occurs over the network against the DedeBIZ administrative interface. The attacker requires low-privileged authenticated access, then issues a crafted multipart request that supplies a malicious litpic file. No user interaction is required beyond the attacker's own session. Public disclosure references, including the GitHub write-up and the VulDB entry, describe the request flow.

No verified proof-of-concept code is included here. See the technical write-up for exploitation details.

Detection Methods for CVE-2024-7905

Indicators of Compromise

Unexpected files with executable extensions (.php, .phtml, .phar) written under DedeBIZ upload directories such as uploads/ or data/.
POST requests to admin/archives_do.php containing a litpic parameter with non-image content or mismatched MIME types.
New administrative sessions immediately followed by file writes and outbound connections from the web server process.

Detection Strategies

Inspect web server access logs for POST requests to admin/archives_do.php referencing the litpic field, especially from unusual source IPs.
Correlate file-system creation events under the DedeBIZ webroot with the php-fpm or web server process to catch upload-driven script drops.
Alert on child processes spawned by the web server, such as shells or system utilities executed by uploaded scripts.

Monitoring Recommendations

Enable file integrity monitoring on the DedeBIZ webroot and upload directories.
Forward web server, PHP, and OS process telemetry to a centralized analytics platform for correlation.
Baseline administrative activity on admin/archives_do.php and flag deviations in request volume or parameter content.

How to Mitigate CVE-2024-7905

Immediate Actions Required

Restrict network access to the DedeBIZ administrative interface using an allow-list or VPN.
Rotate all administrative credentials and audit accounts with upload privileges.
Review upload directories for unauthorized files and remove any suspicious artifacts.
Deploy a web application firewall rule that blocks non-image content in the litpic parameter.

Patch Information

At the time of publication, the vendor had not responded to the disclosure and no official patch is referenced in the NVD entry. Monitor the VulDB advisory and the DedeBIZ project channels for future updates. Until a fix is issued, treat DedeBIZ 6.3.0 as unpatched.

Workarounds

Enforce server-side validation that rejects non-image MIME types and extensions on the upload endpoint.
Configure the web server to disable script execution inside upload directories using directives such as php_admin_flag engine off.
Isolate the DedeBIZ instance behind a reverse proxy that inspects and normalizes multipart uploads.

bash

# Example nginx configuration to disable PHP execution in upload paths
location ~* ^/(uploads|data)/.*\.(php|phtml|phar)$ {
    deny all;
    return 403;
}