CVE-2024-9659: School Management System WordPress RCE Flaw

CVE-2024-9659 Overview

The School Management System for WordPress plugin contains a critical arbitrary file upload vulnerability in the mj_smgt_user_avatar_image_upload() function. Due to missing file type validation, unauthenticated attackers can upload arbitrary files to affected WordPress sites, potentially enabling remote code execution. This vulnerability affects all versions of the plugin up to and including version 91.5.0.

Critical Impact

Unauthenticated attackers can upload malicious files such as PHP web shells to vulnerable WordPress installations, leading to complete server compromise through remote code execution.

Affected Products

• Dasinfomedia School Management System for WordPress versions up to and including 91.5.0
• WordPress installations with the School Management System plugin activated

Discovery Timeline

• 2024-11-23 - CVE-2024-9659 published to NVD
• 2025-07-12 - Last updated in NVD database

Technical Details for CVE-2024-9659

Vulnerability Analysis

This vulnerability is classified as CWE-434 (Unrestricted Upload of File with Dangerous Type). The mj_smgt_user_avatar_image_upload() function in the School Management System plugin fails to implement proper file type validation before processing uploaded files. This critical oversight allows attackers to bypass intended restrictions and upload executable files such as PHP scripts to the web server.

The vulnerability is particularly severe because it requires no authentication to exploit. Any remote attacker with network access to the WordPress installation can craft a malicious request targeting the avatar upload functionality. Once a malicious file is uploaded to the server, the attacker can execute arbitrary code with the privileges of the web server process, potentially leading to complete site takeover, data theft, or lateral movement within the hosting infrastructure.

Root Cause

The root cause of this vulnerability is the absence of server-side file type validation in the mj_smgt_user_avatar_image_upload() function. The function processes file uploads without verifying that the uploaded content matches expected image file types (such as JPEG, PNG, or GIF). This allows attackers to upload files with executable extensions like .php, .phtml, or other server-side scripting formats that can be executed by the web server.

Attack Vector

The attack vector is network-based and requires no user interaction or privileges. An attacker can exploit this vulnerability by sending a crafted HTTP POST request to the vulnerable endpoint with a malicious file disguised as an avatar image. The attack flow typically follows these steps:

1. The attacker identifies a WordPress installation running a vulnerable version of the School Management System plugin
2. A malicious PHP file (such as a web shell) is prepared for upload
3. The attacker sends a POST request to the avatar upload endpoint with the malicious payload
4. Due to missing validation, the server accepts and stores the file in a web-accessible directory
5. The attacker accesses the uploaded file via its URL, triggering execution of the malicious code

For technical details on the exploitation mechanism, refer to the Wordfence Vulnerability Report.

Detection Methods for CVE-2024-9659

Indicators of Compromise

• Unexpected PHP files or web shells appearing in WordPress upload directories, particularly in avatar or user-related folders
• Web server access logs showing POST requests to avatar upload endpoints followed by GET requests to unusual file paths
• Presence of files with double extensions (e.g., avatar.php.jpg) or obfuscated PHP code in upload directories
• Unusual outbound network connections originating from the web server process

Detection Strategies

• Monitor WordPress upload directories for creation of files with executable extensions (.php, .phtml, .php5, etc.)
• Implement file integrity monitoring on the WordPress installation to detect unauthorized file additions
• Review web server access logs for suspicious patterns involving the mj_smgt_user_avatar_image_upload endpoint
• Deploy web application firewalls (WAF) with rules to detect malicious file upload attempts

Monitoring Recommendations

• Enable detailed logging for file upload operations on WordPress installations
• Configure alerts for new file creation events in web-accessible directories outside of normal content management workflows
• Implement real-time monitoring of web server processes for spawned shells or unexpected child processes
• Regularly scan upload directories with malware detection tools to identify web shells or backdoors

How to Mitigate CVE-2024-9659

Immediate Actions Required

• Update the School Management System for WordPress plugin to the latest patched version immediately
• Audit upload directories for any suspicious files that may have been uploaded prior to patching
• Temporarily disable the plugin if an update is not immediately available
• Implement server-level file upload restrictions to block PHP and other executable file types in upload directories

Patch Information

WordPress administrators should update the School Management System plugin to a version newer than 91.5.0 where this vulnerability has been addressed. The plugin is available through CodeCanyon. Verify the installed version through the WordPress admin panel under Plugins and compare against the latest available release.

Workarounds

• Disable the avatar upload functionality by modifying the plugin code to remove or restrict access to the mj_smgt_user_avatar_image_upload() function
• Implement server-level restrictions using .htaccess or web server configuration to prevent PHP execution in upload directories
• Use a web application firewall to filter and block requests containing malicious file upload payloads
• Restrict network access to the WordPress administrative endpoints using IP whitelisting where feasible

# Apache .htaccess configuration to prevent PHP execution in uploads directory
<Directory "/path/to/wordpress/wp-content/uploads">
    <FilesMatch "\.(?:php|phtml|php[3-7]|phps)$">
        Require all denied
    </FilesMatch>
</Directory>