CVE-2024-6439 is a medium severity (CVSS 6.3) unrestricted file upload flaw in SourceCodester Home Owners Collection Management System 1.0. It sits in the user save handler and can be reached remotely. The record lists no patched version, so the practical fix is to remove, isolate or rewrite the code.
What's affected
The record names one product and one version: Home Owners Collection Management System 1.0 from SourceCodester. The affected code is the file /classes/Users.php, called with f=save, and the weak input is the img argument.
The weakness is CWE-434, unrestricted upload of a file with a dangerous type. The vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L, which means a low privilege account is needed and the impact on each of confidentiality, integrity and availability is rated low.
The record says the exploit has been disclosed publicly, with a write-up on GitHub and an entry in VulDB (VDB-270167). The record's KEV flag is false, so this is not a CISA Known Exploited entry. Public disclosure does not mean confirmed attacks, but it does mean the issue is easy to find.
SourceCodester projects are usually sample applications offered as free downloads. I could not load the GitHub write-up or VulDB page during review, so no vendor patch information is available from this record.
How to check if you're exposed
- Search your estate for the project name, and for the route in question:
grep -rn "Users.php" /var/www --include=*.php -l
- Look at the web root for an uploads directory and check what has been written to it recently. Unexpected script files (.php, .phtml) in an image folder are a red flag.
- Review web server logs for POST requests to
/classes/Users.php?f=savefrom addresses you do not know. - Check whether the application is reachable from outside your network.
What to do now
- If you installed this project for a demo or a course, take it offline.
- If it must stay, put it behind authentication at the web server and an IP allow list.
- Configure the web server so the upload directory cannot execute scripts.
- Add a server side check on uploads: allow only the image types you need, check the content and not only the extension, and store files with generated names.
- Remove any suspicious files found in step 2 of the checks above, then rotate database and admin credentials as a precaution.
Why it matters
Upload handlers are a common route from a web form to code running on the server. If the application accepts a file as a profile image without confirming it is an image, and the server will execute what is stored, an attacker can place their own code there.
This flaw needs a low privilege account, which is why the score stays in the medium band. On a small site where anyone can register, that bar is low.
Quick check
Is there a patched version?
The record lists none. Version 1.0 is the only version named, so plan to remove it or fix the upload code yourself.
Is it in the CISA KEV catalog?
No. The record's KEV flag is false. The record does say the exploit is public.
Sources
- NVD record for CVE-2024-6439
- VulDB entry 270167 and the public write-up cited by the record (neither was retrievable when this post was prepared)
Last reviewed: 19 October 2026.
