CVE-2024-48594

Classification basis

The artifact is a complete Metasploit exploit module that actively uploads a PHP webshell and executes it to establish a session, which is the definition of exploit code.

Requirements

• Valid credentials for the Prison Management System application.modules/exploits/linux/http/prison_management_rce.rb:76-77
• Target must be running Prison Management System 1.0 with the vulnerable add-admin.php endpoint accessible.modules/exploits/linux/http/prison_management_rce.rb:19-22

Observed behavior

• Authenticates to the application using provided credentials via a POST request to Admin/login.php.modules/exploits/linux/http/prison_management_rce.rb:97-129
• Uploads a PHP file containing a payload (e.g., Meterpreter, command shell) disguised as a JPEG image via a multipart POST request to Admin/add-admin.php.modules/exploits/linux/http/prison_management_rce.rb:131-175
• Triggers execution of the uploaded PHP webshell by sending a GET request to the predicted upload path (uploadImage/Profile/<filename>.php).modules/exploits/linux/http/prison_management_rce.rb:177-185

Observables

Exploit Behavior

Payload withheldThe module logs in with supplied credentials, uploads a PHP file containing the Metasploit payload to the uploadImage/Profile/ directory, and requests the uploaded file to execute the payload.modules/exploits/linux/http/prison_management_rce.rb:97-129modules/exploits/linux/http/prison_management_rce.rb:131-175modules/exploits/linux/http/prison_management_rce.rb:177-185

Payload Handling

Payload withheldThe module generates the webshell content from the user-selected Metasploit payload. No hardcoded or unrelated payload is present.modules/exploits/linux/http/prison_management_rce.rb:134-141

Cleanup Registration

Payload withheldThe module calls register_file_for_cleanup with the webshell filename, which is standard Metasploit practice for removing artifacts after the session ends.modules/exploits/linux/http/prison_management_rce.rb:172