CVE-2024-28520 in Smart S210 Management Platform
Summary
by MITRE • 04/04/2024
A vulnerability has been found in Beijing Baichuo Smart S210 Management Platform up to 20240117 and classified as critical. This vulnerability affects unknown code of the file /Tool/uploadfile.php. The manipulation of the argument file_upload leads to unrestricted upload. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-252184. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/19/2026
The Beijing Baichuo Smart S210 Management Platform, specifically versions up to the 20240117 build date, contains a critical severity vulnerability within its web application interface that allows for unrestricted file uploads. This flaw is located in the source code of the /Tool/uploadfile.php endpoint and stems from insufficient validation mechanisms governing how user-supplied data is processed during the upload operation. The core technical deficiency lies in the manipulation of the file_upload argument, which fails to enforce strict constraints on file types, extensions, or content verification before saving the uploaded item to the server's filesystem. This lack of input sanitization and type checking creates a direct pathway for attackers to bypass standard security controls that are typically designed to prevent malicious code execution through web interfaces.
From an operational perspective, this vulnerability represents a severe risk because it enables remote code execution potential without requiring authentication in many configurations or with minimal privileges if the upload directory is executable by the web server process. An attacker can exploit this flaw remotely over the network by crafting a request that includes a malicious script file disguised as a legitimate document or image format. Once uploaded, these files often reside in directories where they are directly accessible via HTTP requests, allowing the attacker to invoke them and execute arbitrary commands on the underlying operating system. This capability effectively compromises the confidentiality, integrity, and availability of the management platform and potentially any systems connected to it within the network architecture.
The classification of this issue aligns with Common Weakness Enumeration (CWE) standards, specifically CWE-434 which describes unrestricted upload of file with dangerous type. Furthermore, in terms of tactical behavior as defined by the MITRE ATT&CK framework, this vulnerability facilitates initial access through web application attacks and potentially privilege escalation if the uploaded script gains higher system privileges than intended. The presence of a publicly disclosed exploit significantly lowers the barrier to entry for threat actors, increasing the likelihood of automated scanning and exploitation attempts against exposed instances of this software on the internet.
Despite the critical nature of this vulnerability, vendor engagement has proven ineffective as no response was received following early contact regarding the disclosure. This lack of patching support necessitates immediate defensive actions by system administrators to mitigate risk in production environments. Recommended mitigations include implementing a web application firewall rule set that blocks upload requests targeting the /Tool/uploadfile.php endpoint or restricting file extensions allowed during uploads to only those strictly necessary for business operations, such as .jpg or .pdf with verified MIME type checks. Additionally, deploying the platform behind an intrusion prevention system capable of detecting malicious payloads in HTTP traffic and ensuring that uploaded files are stored outside web-accessible directories can significantly reduce the attack surface until a vendor-provided patch becomes available.