CVE-2024-9815: Tourist Management System RCE Vulnerability

CVE-2024-9815 Overview

CVE-2024-9815 is an unrestricted file upload vulnerability in Codezips Tourist Management System 1.0. The flaw exists in /admin/create-package.php, where the packageimage parameter accepts arbitrary file types without validation. An authenticated attacker can upload malicious files to the server over the network. Public disclosure has occurred through VulDB and GitHub, increasing the risk of opportunistic exploitation. The weakness maps to [CWE-434] Unrestricted Upload of File with Dangerous Type.

Critical Impact
Attackers with administrative privileges can upload arbitrary files through the packageimage parameter, potentially leading to code execution on the web server.

Affected Products

Codezips Tourist Management System 1.0
Component: /admin/create-package.php
CPE: cpe:2.3:a:codezips:tourist_management_system:1.0

Discovery Timeline

2024-10-10 - CVE-2024-9815 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-9815

Vulnerability Analysis

The vulnerability resides in the package creation workflow of the administrative interface. When an administrator submits the create-package form, the application processes the packageimage upload without enforcing MIME type, extension, or content validation. This allows a request to place executable content such as PHP scripts into a web-accessible directory. The attack requires network access to the admin endpoint and authenticated high-privilege access to reach the vulnerable handler. Once a malicious file lands in a served path, the attacker can request it directly and trigger server-side execution. The EPSS score of 0.628% indicates modest but non-trivial exploitation likelihood. Public proof-of-concept material is referenced through VulDB entry #279967 and a GitHub issue tracker.

Root Cause

The create-package.php handler fails to validate the uploaded file's type, extension, and content before writing it to disk. There is no allowlist restricting uploads to expected image formats such as JPEG or PNG, and no verification of magic bytes. This design allows any file supplied through the packageimage form field to be persisted under a predictable path.

Attack Vector

An attacker with administrative credentials sends a crafted multipart HTTP POST request to /admin/create-package.php containing a payload file, typically a PHP web shell, in the packageimage field. After upload, the attacker accesses the file at its stored location to execute arbitrary code in the web server context. Because exploitation requires authenticated administrative access, the primary risk arises from credential compromise, session hijacking, or insider misuse. See the GitHub issue on CVE-2024-9815 and the VulDB entry #279967 for additional technical detail.

Detection Methods for CVE-2024-9815

Indicators of Compromise

Unexpected files with executable extensions such as .php, .phtml, or .phar in upload directories used by the Tourist Management System.
HTTP POST requests to /admin/create-package.php containing multipart form data where the packageimage field carries a non-image Content-Type or filename extension.
Outbound network connections originating from the web server process shortly after a package creation event.

Detection Strategies

Inspect web server access logs for POST requests to create-package.php followed by GET requests to newly created files under image upload paths.
Deploy web application firewall rules that validate Content-Type and file extension on uploads to the admin interface.
Monitor the web root for file integrity changes, alerting on new script files written by the PHP process.

Monitoring Recommendations

Enable verbose HTTP request logging on the administrative interface, including request body metadata for file upload endpoints.
Correlate authentication events with file write activity on the web server to identify anomalous admin sessions.
Track process execution spawned by the PHP interpreter to detect post-upload web shell activity.

How to Mitigate CVE-2024-9815

Immediate Actions Required

Restrict network access to /admin/ paths using IP allowlists or VPN gating until a fix is applied.
Rotate administrative credentials and enforce strong authentication on the Tourist Management System admin panel.
Audit the package image upload directory for unexpected files and remove any non-image content.

Patch Information

No vendor patch or advisory is currently listed for Codezips Tourist Management System 1.0. Organizations should monitor the vendor for updates and consider replacing the affected application if remediation is not forthcoming. Reference the VulDB CTI entry for tracking updates.

Workarounds

Modify create-package.php to validate uploaded files against an allowlist of image MIME types and extensions, and verify file signatures before writing to disk.
Configure the web server to disable script execution within upload directories using directives such as php_flag engine off or equivalent handler restrictions.
Store uploaded files outside the web root and serve them through a controlled handler that enforces content-type restrictions.

bash

# Example Apache configuration to disable PHP execution in upload directory
<Directory "/var/www/tourist_management_system/uploads">
    php_flag engine off
    RemoveHandler .php .phtml .phar
    RemoveType .php .phtml .phar
    <FilesMatch "\.(php|phtml|phar)$">
        Require all denied
    </FilesMatch>
</Directory>