CVE-2022-43146

Vulnerability

The Canteen Management System v1.0, available as open-source PHP code [1], contains a file upload vulnerability in its image upload functionality. The application does not properly validate the file type or extension of uploaded images, allowing an attacker to upload a malicious PHP file instead of a legitimate image [1]. This arbitrary file upload vulnerability resides in the food management or category management modules where images are accepted.

Exploitation

An attacker needs only network access to the web application and does not require authentication or special privileges. The attacker crafts a PHP file containing malicious code (e.g., a web shell) and uploads it through the image upload form. The application accepts the file because it only checks the MIME type based on client input or relies solely on the file extension, but does not verify the file contents [1]. After upload, the PHP file is stored in a web-accessible directory, and the attacker can then directly access the file to execute arbitrary PHP code on the server.

Impact

Successful exploitation allows the attacker to execute arbitrary PHP code on the underlying web server. This can lead to full remote code execution (RCE) with the privileges of the web server user, enabling the attacker to read, modify, or delete sensitive data, install malware, or pivot to internal systems. The CIA impact is high: confidentiality, integrity, and availability of the application and server are compromised.

Mitigation

As of the publication date (2022-11-14), no official patch or fixed version has been released by the vendor for Canteen Management System v1.0 [1]. It is recommended to implement proper file upload validation, such as checking the file's content type against a whitelist of allowed image formats, renaming uploaded files with a secure extension, and storing them outside the web root. Additionally, disabling execution of PHP files in the upload directory via web server configuration (e.g., a .htaccess file) can serve as a workaround.