CVE-2024-7906: Dedebiz 6.3.0 RCE Vulnerability

CVE-2024-7906 Overview

CVE-2024-7906 is an unrestricted file upload vulnerability in DedeBIZ 6.3.0. The flaw resides in the get_mime_type function within /admin/dialog/select_images_post.php, part of the Attachment Settings component. Attackers can manipulate the upload argument to bypass file type validation and upload arbitrary files remotely. The exploit details have been publicly disclosed, increasing exposure risk for affected deployments. The vendor was contacted before disclosure but did not respond, meaning no official patch coordination occurred. The vulnerability is tracked as [CWE-434] Unrestricted Upload of File with Dangerous Type.

Critical Impact
Authenticated remote attackers can upload arbitrary files to a DedeBIZ 6.3.0 server through the Attachment Settings interface, potentially leading to code execution on the web server.

Affected Products

DedeBIZ 6.3.0
Component: /admin/dialog/select_images_post.php
Function: get_mime_type (Attachment Settings)

Discovery Timeline

2024-08-18 - CVE-2024-7906 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-7906

Vulnerability Analysis

The vulnerability is an unrestricted file upload defect classified under [CWE-434]. It exists in the get_mime_type routine used by /admin/dialog/select_images_post.php in DedeBIZ 6.3.0. This routine is responsible for determining the MIME type of files submitted through the Attachment Settings interface. Because MIME type detection is used as the primary validation gate, attackers can manipulate the upload parameter to submit files whose reported type differs from their actual content. Server-side controls fail to block executable content such as PHP scripts, allowing attackers to place hostile files inside the web root.

Root Cause

The root cause is reliance on client-supplied or weakly inferred MIME data inside get_mime_type without enforcing an allowlist of extensions or validating file contents. The function does not reject files whose extension resolves to server-executable handlers. As a result, requests to select_images_post.php accept attacker-controlled payloads through the upload argument.

Attack Vector

Exploitation occurs over the network against the DedeBIZ administrative interface. An attacker with low-level privileges submits a crafted multipart request to /admin/dialog/select_images_post.php with the upload parameter set to a malicious file carrying a spoofed MIME type. If the upload succeeds, the attacker requests the stored file directly through the web server to trigger execution. Full technical detail is available in the public write-up: GitHub CVE Details and VulDB #275032.

Detection Methods for CVE-2024-7906

Indicators of Compromise

POST requests to /admin/dialog/select_images_post.php containing an upload parameter with executable file extensions such as .php, .phtml, or .php5.
Newly created files inside the DedeBIZ uploads or attachment directories with server-executable extensions.
Outbound connections from the web server process shortly after successful uploads, suggesting webshell activity.
Administrative session activity from unusual source IP addresses immediately preceding file writes.

Detection Strategies

Inspect web server access logs for POST traffic to select_images_post.php and correlate with authenticated admin sessions.
Enable file integrity monitoring on the DedeBIZ web root and attachment directories to flag creation of PHP or script files.
Deploy web application firewall rules that block uploads based on real file signature rather than declared MIME type.

Monitoring Recommendations

Alert on any process spawned by the web server user that executes a shell interpreter or outbound network utility.
Track admin panel authentication events and correlate with subsequent upload activity within short time windows.
Review scheduled task and cron changes on the host to detect persistence added through uploaded scripts.

How to Mitigate CVE-2024-7906

Immediate Actions Required

Restrict network access to the DedeBIZ /admin/ path so only trusted administrative IP ranges can reach select_images_post.php.
Rotate all administrator credentials and audit admin accounts for unauthorized additions.
Inspect the attachment upload directories for any unexpected files and remove suspicious payloads.
Enforce strong authentication on the DedeBIZ admin console to reduce the pool of accounts that can reach the vulnerable endpoint.

Patch Information

No vendor patch has been published. The VulDB advisory records that the vendor was contacted but did not respond. Operators of DedeBIZ 6.3.0 must apply compensating controls until an official fix is released. Track vendor channels for updated releases and evaluate migration to alternative content management platforms if a patch does not appear.

Workarounds

Configure the web server to deny execution of PHP and other script handlers inside upload and attachment directories.
Add a reverse proxy or web application firewall rule that blocks multipart uploads to select_images_post.php with executable extensions.
Enforce server-side allowlist validation on file extensions and validate the file signature independently from the client-declared MIME type.
Disable or remove the Attachment Settings dialog if it is not required for daily operations.

bash

# Example nginx configuration to block script execution in upload paths
location ~* ^/(uploads|attachment)/.*\.(php|phtml|php5|phar)$ {
    deny all;
    return 403;
}