CVE-2024-9975: Drag And Drop Image Upload RCE Vulnerability

CVE-2024-9975 Overview

CVE-2024-9975 is an unrestricted file upload vulnerability in SourceCodester Drag and Drop Image Upload 1.0. The flaw resides in the /upload.php endpoint, which fails to validate file types or content before writing uploaded data to disk. Attackers can abuse this weakness remotely by submitting arbitrary files, including server-side scripts. Public exploit details have been disclosed, increasing the likelihood of opportunistic exploitation against exposed instances. The vulnerability is categorized under CWE-434: Unrestricted Upload of File with Dangerous Type and can serve as a foothold for remote code execution on affected web servers.

Critical Impact
Successful exploitation lets a remote attacker upload arbitrary files to the target web server, potentially achieving remote code execution and full application compromise.

Affected Products

SourceCodester Drag and Drop Image Upload 1.0
Component: /upload.php
Vendor identifier: rems:drag_and_drop_image_upload

Discovery Timeline

2024-10-15 - CVE-2024-9975 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-9975

Vulnerability Analysis

The vulnerability exists in the file upload handler exposed at /upload.php. The application accepts file uploads via an AJAX-driven drag-and-drop interface but does not enforce restrictions on file extension, MIME type, or content. This design flaw allows attackers to upload files that the web server will execute, such as PHP scripts, alongside legitimate image formats.

Because the endpoint is reachable over the network and requires only low-privileged access, an attacker can deliver a malicious payload with a single HTTP POST request. Once written to a web-accessible directory, the file can be requested directly to trigger execution. This turns a file upload feature into an arbitrary code execution primitive on the underlying server.

The issue aligns with CWE-434, where the absence of allowlist-based validation transforms a benign feature into a full compromise path. Public technical write-ups describe the exact request structure needed to reproduce the flaw.

Root Cause

The root cause is missing server-side validation in /upload.php. The handler trusts client-supplied filenames and extensions, does not verify file signatures, and stores uploads in a directory that the web server interprets as executable content. Any authenticated or minimally-authorized user reaching the endpoint can bypass what should be an image-only workflow.

Attack Vector

The attack is remote and network-based. An attacker crafts a multipart HTTP POST request to /upload.php containing a payload file with a script extension such as .php or a double extension like image.php.jpg. After the server stores the file in the uploads directory, the attacker requests the uploaded script directly, causing the PHP interpreter to execute it. The result is arbitrary command execution in the context of the web server process. See the public proof-of-concept write-up for reproduction steps.

Detection Methods for CVE-2024-9975

Indicators of Compromise

Unexpected files with executable extensions (.php, .phtml, .phar) present in the application's uploads directory.
Web server access logs showing POST requests to /upload.php followed by GET requests to newly created files in the uploads path.
Outbound network connections initiated by the web server process to unknown external hosts shortly after an upload event.
Filenames containing double extensions or null-byte sequences submitted to /upload.php.

Detection Strategies

Inspect HTTP traffic for multipart uploads to /upload.php where the Content-Type or file extension does not match an approved image format.
Baseline the contents of the uploads directory and alert on the creation of any file whose extension is not on an allowlist of image types.
Correlate web request logs with process telemetry on the host to detect php-fpm or apache2 spawning shells, curl, wget, or nc immediately after an upload.

Monitoring Recommendations

Enable verbose access and error logging on the web server hosting the application and forward logs to a centralized analytics platform.
Monitor for anomalous child processes of the web server user, which is a strong signal of successful web shell execution.
Track file integrity in application directories with scheduled hashing to identify unauthorized writes.

How to Mitigate CVE-2024-9975

Immediate Actions Required

Remove or restrict network access to the /upload.php endpoint until the application can be secured.
Audit the uploads directory for suspicious files and remove any non-image content.
Rotate credentials and review web server logs for signs of prior exploitation.
Configure the web server so that files inside the uploads directory cannot be executed as scripts.

Patch Information

No official vendor patch has been published for SourceCodester Drag and Drop Image Upload 1.0. Consult the SourceCodester project page and the VulDB entry for updates. Organizations running this codebase should treat it as end-of-support and consider replacing it with an actively maintained upload component.

Workarounds

Enforce a strict server-side allowlist of image MIME types and validate file magic bytes before writing uploads to disk.
Rename uploaded files to server-generated identifiers and strip original extensions to prevent script execution.
Store uploads outside the web root and serve them through a controlled handler that sets safe Content-Type headers.
Place the application behind a web application firewall configured to block requests containing script extensions in multipart file fields.

bash

# Apache configuration example: disable script execution in the uploads directory
<Directory "/var/www/html/uploads">
    php_admin_flag engine off
    SetHandler none
    RemoveHandler .php .phtml .phar
    RemoveType .php .phtml .phar
    Options -ExecCGI
    AllowOverride None
</Directory>