CVE-2024-57668
Published: 06 February 2025
Summary
CVE-2024-57668 is a high-severity Unrestricted Upload of File with Dangerous Type (CWE-434) vulnerability in Fabian Shopping Portal. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 22.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-3 (Malicious Code Protection).
Deeper analysis
CVE-2024-57668 is an arbitrary file upload vulnerability (CWE-434) affecting Code-projects Shopping Portal version 1.0, specifically in the insert-product.php page. This flaw allows unrestricted upload of files with dangerous types, earning a high CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating significant potential for remote exploitation with low complexity and low privileges required.
An attacker with low privileges, such as a registered user on the shopping portal, can exploit this vulnerability over the network without user interaction. By submitting malicious files through the insert-product.php endpoint, they can achieve high impacts on confidentiality, integrity, and availability, potentially leading to server-side code execution, data compromise, or system disruption depending on the uploaded file type and server configuration.
Advisories and details are documented in references including the project's source code page at https://code-projects.org/shopping-portal-using-php-source-code/ and a vulnerability report at https://github.com/passevery/vul/issues/1. No specific patches or mitigations are detailed in the provided information.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-53698
Vulnerability details
In Code-projects Shopping Portal v1.0, the insert-product.php page has an arbitrary file upload vulnerability.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Arbitrary file upload in public-facing PHP web application (insert-product.php) enables exploitation of public-facing application (T1190) and uploading/executing web shells or Trojans (T1100) for remote code execution and server compromise.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly prevents arbitrary file uploads in insert-product.php by validating file types, sizes, and contents against expected product insertion requirements.
Restricts uploads in insert-product.php to only permitted safe file types and formats, blocking dangerous arbitrary files from low-privilege users.
Scans and blocks malicious code in uploaded files via insert-product.php, mitigating remote code execution from webshells or executables.