CVE-2024-8342 Overview
CVE-2024-8342 is an unrestricted file upload vulnerability in SourceCodester Petshop Management System 1.0, developed by nelzkie15. The flaw resides in /controllers/add_client.php, where the image_profile parameter accepts arbitrary file uploads without validation [CWE-434]. Authenticated remote attackers can abuse this endpoint to upload malicious files to the web server. The exploit details have been publicly disclosed, increasing the risk of opportunistic attacks against exposed installations.
Critical Impact
Remote authenticated attackers can upload arbitrary files through the image_profile parameter, potentially leading to web shell deployment and server compromise.
Affected Products
- Nelzkie15 Pet Shop Management System 1.0
- SourceCodester Petshop Management System 1.0
- cpe:2.3:a:nelzkie15:pet_shop_management_system:1.0
Discovery Timeline
- 2024-08-30 - CVE-2024-8342 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-8342
Vulnerability Analysis
The vulnerability affects the client registration workflow in the Petshop Management System. When users submit profile data through /controllers/add_client.php, the application accepts the image_profile file parameter without enforcing file type, extension, or content restrictions. This behavior enables attackers to upload executable server-side scripts such as PHP files instead of the expected image formats.
The issue is classified under CWE-434: Unrestricted Upload of File with Dangerous Type. An attacker with low-privilege access to the application can weaponize the endpoint remotely over the network. The EPSS score of 0.643% reflects moderate probability of exploitation activity in the near term.
According to the GitHub PoC Repository, the exploit has been publicly documented, lowering the barrier for attackers to reproduce the attack chain.
Root Cause
The root cause is missing server-side validation of uploaded file attributes. The add_client.php controller does not verify MIME type, file extension, magic bytes, or the destination path for the image_profile field. Uploaded files are written to a web-accessible directory, allowing direct execution through the browser.
Attack Vector
An attacker submits a crafted multipart POST request to /controllers/add_client.php with a PHP payload masquerading as an image in the image_profile field. Once the file lands in the uploads directory, the attacker requests the file URL to trigger server-side execution and gain interactive control over the web application.
See the VulDB entry #276221 for additional exploitation context.
Detection Methods for CVE-2024-8342
Indicators of Compromise
- Unexpected .php, .phtml, .phar, or double-extension files (e.g., shell.php.jpg) inside the Petshop Management System uploads directory.
- POST requests to /controllers/add_client.php containing non-image Content-Type headers or PHP magic bytes in the image_profile field.
- Subsequent GET requests to uploaded filenames from unfamiliar external IP addresses.
Detection Strategies
- Inspect web server access logs for POST activity against add_client.php followed by direct GET requests to newly created files in the uploads path.
- Deploy web application firewall rules that inspect multipart uploads for PHP tags (<?php, <?=) and block non-image content in image fields.
- Perform file integrity monitoring on the application's upload directory to detect creation of executable script files.
Monitoring Recommendations
- Alert on new server-side script files written under directories intended for user-uploaded media.
- Monitor outbound network connections initiated by the PHP-FPM or Apache worker process, which may indicate a live web shell.
- Correlate authentication events with file upload activity to identify low-privilege accounts abusing the client registration flow.
How to Mitigate CVE-2024-8342
Immediate Actions Required
- Restrict network access to the Petshop Management System until validation controls are implemented.
- Audit the uploads/ directory and remove any files that are not legitimate profile images.
- Rotate credentials for all application accounts, since low-privilege access is sufficient to trigger the flaw.
Patch Information
No official vendor patch is listed in the SourceCodester Security Resources or the VulDB submission #399662. Organizations running Petshop Management System 1.0 should treat the software as unsupported and apply compensating controls or replace it with a maintained alternative.
Workarounds
- Modify add_client.php to validate image_profile against a strict allowlist of MIME types (image/jpeg, image/png) and verify magic bytes server-side.
- Rename uploaded files to server-generated identifiers and store them outside the web root, serving them through a controlled download handler.
- Configure the web server to disable PHP execution in the uploads directory using php_admin_flag engine off or equivalent Nginx location rules.
- Enforce authentication and rate-limiting on the /controllers/add_client.php endpoint to reduce exposure to automated exploitation.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
