CVE-2024-7328

Executive Summary

CVE-2024-7328 is a problematic information disclosure vulnerability in YouDianCMS version 7. The flaw resides in the /t.php?action=phpinfo endpoint, which exposes detailed PHP configuration information to any unauthenticated remote attacker. This disclosure can reveal sensitive server paths, loaded extensions, environment variables, and database credentials, aiding further exploitation. The vendor was contacted but did not respond, leaving the vulnerability unpatched. The exploit has been publicly disclosed, increasing the risk of active scanning and exploitation.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (NVD) / Adjusted: 5.3 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: Low
• Integrity Impact: None
• Availability Impact: None
• Threat Level: Medium – While the direct impact is limited to information disclosure, the leaked data can enable more severe attacks.

Deep Dive & Mechanics

The vulnerability is a classic case of an exposed diagnostic endpoint. The file /t.php in YouDianCMS 7 accepts an action parameter. When action=phpinfo is passed, the script calls phpinfo(), which outputs a comprehensive HTML page containing the PHP configuration. This includes:

• Server software and version
• Document root and file paths
• Loaded PHP extensions (e.g., MySQL, OpenSSL)
• Environment variables (may contain API keys or secrets)
• Database connection details if stored in environment
• System temporary directories

The attack is trivial: an unauthenticated HTTP GET request to http://target/t.php?action=phpinfo returns the full phpinfo output. No authentication or special headers are required.

Vulnerable vs. Patched Code

Vulnerable Code (YouDianCMS 7): The file /t.php likely contains a switch or if-else block that calls phpinfo() when action=phpinfo is set. Example:

<?php
$action = $_GET['action'] ?? '';
if ($action == 'phpinfo') {
    phpinfo();
}
?>

Patched Code (Hypothetical): A secure version would either remove the diagnostic endpoint entirely or restrict access to authenticated administrators only:

<?php
session_start();
if (!isset($_SESSION['admin']) || $_SESSION['admin'] !== true) {
    die('Access denied');
}
$action = $_GET['action'] ?? '';
if ($action == 'phpinfo') {
    phpinfo();
}
?>

Since no official patch exists, the only mitigation is to manually remove or restrict the file.

Exploitation & Lab Setup

Red Team

Lab Setup:

1. Deploy YouDianCMS 7 on a local server (e.g., XAMPP, Docker).
2. Ensure the /t.php file is present.

Exploitation Steps:

1. Open a browser or use curl:

   curl http://target/t.php?action=phpinfo
   

2. The response will contain the full phpinfo output. Save it for analysis:

   curl http://target/t.php?action=phpinfo > phpinfo_output.html
   

3. Parse the output for sensitive data (e.g., DOCUMENT_ROOT, SERVER_ADMIN, environment variables).

Automated Scanning: Use nuclei with a custom template (see Detection Engineering) or a simple script:

import requests
target = "http://target/t.php?action=phpinfo"
r = requests.get(target)
if "PHP Version" in r.text:
    print("Vulnerable")

Blue Team

Detection:

• Monitor web server logs for requests to /t.php?action=phpinfo.
• Alert on any access to this endpoint from external IPs.

Hunting:

• Search for phpinfo in HTTP request URIs.
• Look for responses containing PHP Version in the body.

Containment:

• Immediately remove or rename /t.php on production servers.
• Block access to /t.php via web server configuration (e.g., .htaccess):

  <Files "t.php">
      Require all denied
  </Files>
  

Indicators of Compromise (IOCs)

• Network:
  • HTTP GET requests to /t.php?action=phpinfo
  • Responses containing PHP Version and phpinfo() HTML structure
• File:
  • Presence of /t.php in the web root
• Logs:
  • Web server access log entries with "GET /t.php?action=phpinfo HTTP/1.1" 200

Detection Engineering

YARA Rule

rule CVE_2024_7328_phpinfo_disclosure {
    meta:
        description = "Detects phpinfo() output from YouDianCMS CVE-2024-7328"
        author = "Valters IT"
        date = "2024-08-01"
        hash = "unknown"
    strings:
        $phpinfo = "PHP Version" nocase
        $action = "action=phpinfo" nocase
        $tphp = "/t.php" nocase
    condition:
        $phpinfo and $action and $tphp
}

Sigma Rule

title: YouDianCMS phpinfo Disclosure (CVE-2024-7328)
id: 8a3f7c2e-1d4b-4f6a-9c8e-0b2a5d7f3e1c
status: experimental
description: Detects access to /t.php?action=phpinfo which exposes PHP configuration
author: Valters IT
date: 2024/08/01
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query: '/t.php?action=phpinfo'
    condition: selection
falsepositives:
    - Legitimate admin debugging
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-7328 YouDianCMS phpinfo Disclosure"; flow:to_server,established; content:"GET"; http_method; content:"/t.php"; http_uri; content:"action=phpinfo"; http_uri; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Remove or rename /t.php from the web root.
2. Block access to /t.php via web server rules (e.g., .htaccess, Nginx location block).
3. Review server logs for any prior exploitation attempts.

Long-term:

• Migrate to a supported CMS or apply custom hardening.
• Implement a Web Application Firewall (WAF) rule to block requests containing phpinfo in the URI.
• Regularly audit for exposed diagnostic endpoints.

Workaround: If the file is needed for debugging, restrict access by IP or require authentication:

if ($_SERVER['REMOTE_ADDR'] !== '127.0.0.1') {
    die('Access denied');
}

Valters IT
Securing Digital Frontiers