CVE-2024-53345: Arbitrary File Upload in Car Rental Management System

CVE-2024-53345 is a critical vulnerability affecting the Car Rental Management System versions 1.0 through 1.3. The vulnerability exists within the file upload functionality of the System Settings module, where improper validation of file types allows users with low privileges to upload arbitrary files, including executable PHP scripts. The application fails to enforce access controls on the upload directory, enabling attackers to retrieve the uploaded shell. Once a malicious PHP script is stored, an attacker can execute arbitrary system commands by supplying a 'cmd' parameter to the URL of the uploaded file. Depending on the server configuration, this vulnerability may be exploitable without authentication, leading to full server compromise, data exfiltration, and potential lateral movement within the network. The public availability of functional exploit code significantly increases the risk to organizations running this software.

Attack Chain

1. The attacker identifies a target instance of the Car Rental Management System (v1.0-1.3).
2. The attacker obtains a valid session ID (PHPSESSID) or identifies a misconfigured deployment that permits unauthenticated access to the file upload feature.
3. The attacker sends a POST request to the file upload endpoint within the System Settings module.
4. The request includes a malicious PHP web shell disguised as a legitimate file, bypassing inadequate server-side validation.
5. The server writes the PHP shell to the target directory, typically located at '/car_rental/admin/assets/uploads/'.
6. The attacker sends a GET or POST request to the newly uploaded file path, appending the 'cmd' parameter (e.g., /car_rental/admin/assets/uploads/shell.php?cmd=whoami).
7. The server-side script executes the provided command via the shell, returning the output to the attacker.
8. The attacker achieves remote code execution (RCE) on the underlying host, facilitating further exploitation or data theft.

Impact

Successful exploitation of this vulnerability results in remote code execution, granting the attacker unauthorized control over the host server. This allows for the compromise of sensitive data stored within the Car Rental Management System, escalation of privileges, and potential lateral movement into the wider internal network. The severity is compounded by the ease of execution once the initial shell is uploaded.

Recommendation

• Identify and audit all instances of the Car Rental Management System running versions 1.0-1.3 within the network.
• Apply strict server-side validation to ensure that only expected file types are permitted during upload, specifically blocking '.php' and other script extensions.
• Reconfigure the web server to disable the execution of scripts within the upload directory (e.g., using 'php_flag engine off' in Apache or equivalent restrictions in Nginx).
• Restrict access to the file upload functionality to authorized administrative users only.
• Monitor web server logs for suspicious requests targeting '/car_rental/admin/assets/uploads/' with common shell filenames or the presence of the 'cmd' query parameter.