MobileCartly Remote File Upload Exploit

Summary

MobileCartly 1.0 Remote suffers from file upload vulnerability.

Credit:

The information has been provided by ICheer_No0M.


Details

Vulnerable Systems:
 * MobileCartly 1.0

# 1. Vuln Code : /images/uploadprocess.php
#
# /*$zip = new ZipArchive;
# $zip->open($_FILES[‘uploadedfile’][‘tmp_name’]);
# $zip->extractTo(‘productimages/’);
# $zip->close(); */
#
# You can upload shell.php on /images/upload.php
# Find your shell on /productimages/shell.php
#
#
# 2. Vuln Code : /includes/logo-upload-process.php
# /*if (($_FILES[‘logo-upload’][‘type’] == ‘image/gif’)
# || ($_FILES[‘logo-upload’][‘type’] == ‘image/jpeg’)
# || ($_FILES[‘logo-upload’][‘type’] == ‘image/pjpeg’)
# && ($_FILES[‘logo-upload’][‘size’] < 20000))*/
#
# You can upload shell on /includes/upload-logo.php and edit header values.
# Find your shell on /images/logo/shell.php
#
#

Disclosure Timeline:
Published: 2012-08-15

Categories: Exploits