CVE-2024-31777

published 2024-06-13

CVE-2024-31777: File Upload vulnerability in openeclass v.3.15 and before allows an attacker to execute arbitrary code via a crafted file to the certbadge.php endpoint.

Priority P2 63 critical 9.8 CVSS 3.1

AV N AC L PR N UI N S U C H I H A H

EXPLOIT

File Upload vulnerability in openeclass v.3.15 and before allows an attacker to execute arbitrary code via a crafted file to the certbadge.php endpoint.

Affected

1 ranges

Vendor	Product	Version range	Fixed in
openeclass	openeclass	<= 3.15	—

Detection & IOCs extracted from sources · hover to see the quote

path /modules/admin/certbadge.php↗

path /courses/user_progress_data/cert_templates/↗

url /modules/admin/certbadge.php?action=add_cert↗

command ?cmd=rm%20evil.zip↗

command ?cmd=rm%20evil.php↗

• → Detect POST requests to the certbadge.php add_cert endpoint uploading a ZIP file — the exploit uploads a ZIP archive containing a PHP webshell via the 'filename' multipart field with content-type application/zip. ↗
• → Monitor for PHP file creation under the cert_templates directory — the ZIP is extracted and a .php webshell lands at /courses/user_progress_data/cert_templates/. ↗
• → Alert on GET requests to files under /courses/user_progress_data/cert_templates/ containing a 'cmd' query parameter — this is the webshell command execution pattern used post-upload. ↗
• → The exploit requires authenticated access; look for login attempts to /?login_page=1 followed shortly by a POST to /modules/admin/certbadge.php?action=add_cert from the same session/IP. ↗
• → The multipart upload uses the form field name 'submit_cert_template' as a trigger — presence of this field alongside a ZIP file upload to certbadge.php is a strong exploit indicator. ↗

• · Exploitation requires valid authenticated credentials — this is not an unauthenticated file upload; the attacker must first log in via the standard login form before reaching the vulnerable certbadge.php endpoint. ↗
• · The vulnerability affects openeclass v3.15 and before — all versions up to and including 3.15 are in scope. ↗

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-434