Prison Management System 1.0 Authenticated RCE via Unrestricted File Upload
PoC files
1 fileFile viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.
Analysis
Technical assessment
A Metasploit module that exploits an authenticated unrestricted file upload vulnerability (CVE-2024-48594) in Prison Management System 1.0 to achieve remote code execution by uploading a PHP webshell via the avatar upload in add-admin.php.
Backdoor review
No backdoor observed in reviewed code
The module is a standard Metasploit exploit for CVE-2024-48594. It authenticates to Prison Management System 1.0, uploads a PHP webshell via an unrestricted file upload in add-admin.php, and triggers the payload. All behavior is consistent with the stated exploit purpose; no concealed backdoor, unrelated payload, or deceptive operator-directed harm is present.
Classification basis and observed behavior
Classification basis
The artifact is a complete Metasploit exploit module that actively uploads a PHP webshell and executes it to establish a session, which is the definition of exploit code.
modules/exploits/linux/http/prison_management_rce.rb:187-191Requirements
- Valid credentials for the Prison Management System application.
modules/exploits/linux/http/prison_management_rce.rb:76-77 - Target must be running Prison Management System 1.0 with the vulnerable add-admin.php endpoint accessible.
modules/exploits/linux/http/prison_management_rce.rb:19-22
Observed behavior
- Authenticates to the application using provided credentials via a POST request to Admin/login.php.
modules/exploits/linux/http/prison_management_rce.rb:97-129 - Uploads a PHP file containing a payload (e.g., Meterpreter, command shell) disguised as a JPEG image via a multipart POST request to Admin/add-admin.php.
modules/exploits/linux/http/prison_management_rce.rb:131-175 - Triggers execution of the uploaded PHP webshell by sending a GET request to the predicted upload path (uploadImage/Profile/<filename>.php).
modules/exploits/linux/http/prison_management_rce.rb:177-185
Behaviors behind the backdoor verdict
Observables
- Exploit Behavior
- Authenticated file upload of PHP webshell to achieve RCEThe module logs in with supplied credentials, uploads a PHP file containing the Metasploit payload to the uploadImage/Profile/ directory, and requests the uploaded file to execute the payload.
modules/exploits/linux/http/prison_management_rce.rb:97-129modules/exploits/linux/http/prison_management_rce.rb:131-175modules/exploits/linux/http/prison_management_rce.rb:177-185 - Payload Handling
- Uses Metasploit payload.encoded for PHP target; wraps command payloads in base64_decode and system() for Unix Command and Linux Dropper targetsThe module generates the webshell content from the user-selected Metasploit payload. No hardcoded or unrelated payload is present.
modules/exploits/linux/http/prison_management_rce.rb:134-141 - Cleanup Registration
- Registers uploaded webshell for cleanup via FileDropper mixinThe module calls register_file_for_cleanup with the webshell filename, which is standard Metasploit practice for removing artifacts after the session ends.
modules/exploits/linux/http/prison_management_rce.rb:172
What the analysis did not establish
- Analysis is based solely on the module source code and metadata; Metasploit framework mixins, libraries, and external payloads are not expanded.
- The artifact was not executed; classification is based on static analysis of the provided Ruby source code.
- Only the module source and metadata are reviewed; Metasploit framework mixins (HttpClient, FileDropper, AutoCheck) and the actual payload generation are not expanded in the evidence. The behavior of those components is assumed to be standard.
- Binary files are flagged as metadata-only and not analyzed, but no binary files are present in the evidence.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.