CVE-2024-3437 is a high severity unrestricted file upload flaw (CVSS 7.3) in SourceCodester Prison Management System 1.0, in the avatar handler at /Admin/add-admin.php. The record lists no fixed version, so restrict access to the application, block script uploads in the avatar folder and review the code.
What's affected
The record lists SourceCodester Prison Management System 1.0. The weakness is CWE-434 (unrestricted file upload), in the avatar handler component, through the avatar argument of /Admin/add-admin.php. The CVSS vector in the record says the attack is reached over the network, with low attack complexity, needing no privileges and no user interaction.
The description says the attack may be started remotely and that the exploit has been disclosed to the public and may be used. That is a statement about a public write-up, not a report of attacks seen in the wild. The record's KEV flag is false, so CISA's Known Exploited Vulnerabilities catalog did not list it when this record was captured.
No fixed version or vendor patch is listed. I could not confirm one, so check the vendor or project page for updates.
Other records for the same product in this range: CVE-2024-3436, CVE-2024-3438, CVE-2024-3439, CVE-2024-3440, CVE-2024-3441, CVE-2024-3442.
How to check if you're exposed
Start with an inventory. List every place SourceCodester Prison Management System runs in your environment, including test and demo copies that people forget. Note the exact version string on each one and compare it with the versions in the record (1.0). For a PHP application that was copied onto a web server, the version is usually in the project folder name, a readme or the admin page footer, so check the files on disk rather than relying on memory.
Then check whether /Admin/add-admin.php exists under the web root, and look in the upload or avatar folder for files that are not images, such as files ending in php. A script file in a folder meant for pictures is a sign that someone has used the flaw. You can also run a free in-browser dependency scan at gold.safeguard.sh/scan to see which known vulnerabilities touch the open source packages you ship.
Safeguard's reachability analysis helps with the next question, which is whether the vulnerable code is actually called in your application, so you can order the work sensibly.
What to do now
- Take the application off the public internet, or put it behind a VPN or IP allow list.
- Block access to
/Admin/add-admin.phpat the web server or proxy until the code is fixed. - Configure the upload folder so the web server never executes files from it.
- Inspect the avatar and upload folders for files that are not images, and remove anything you cannot explain after keeping a copy for review.
- If you maintain the code, validate file type and content on the server, rename uploads, and restrict who can upload.
Why it matters
Unrestricted file upload means the application accepts a file without checking enough about it, such as its real type, its extension and where it is stored. If the server will run an uploaded script from a web-reachable folder, an upload turns into code running on the server. The record describes the weakness only at the level of the avatar argument and does not say more, and this post does not either.
Safe handling has several layers. Accept only the image types you expect, check the content and not just the name, rename files on save, store them outside the web root or in a folder where the server will not execute scripts, and require a logged in, authorised user for the upload form.
The record's KEV flag is false, so CISA's Known Exploited Vulnerabilities catalog did not list it when this record was captured.
Quick check
Why does the upload folder matter?
If the web server executes scripts in the folder where uploads are stored, an uploaded script can run. Disabling execution there removes that path even before the code is fixed.
Is there a fixed release?
The record lists none. Check the vendor or project page, and plan to patch the code or retire the software if nothing is published.
Sources
- NVD record data for CVE-2024-3437
- Reference links listed in the record, not fetched for this post: https://github.com/fubxx/CVE/blob/main/PrisonManagementSystemRCE2.md, https://vuldb.com/?ctiid.259631, https://vuldb.com/?id.259631
Last reviewed: 19 October 2026.
