[0day-rubbish] Maian Cart 3.8 addBanners unrestricted banner upload to PHP webshell and administrator command execution (7.2 primary, PR:H)
Maian Cart 3.8 allows unrestricted banner uploads that become PHP webshells for administrator command execution.
The 0day Rubbish Research Team disclosed a vulnerability in Maian Cart 3.8, the self-hosted PHP shopping cart from Maian Media. Banner uploads are not restricted by file type (CWE-434), so an attacker-supplied PHP file can act as a webshell and execute OS commands (CWE-78) in an administrator execution context. The researchers say they verified the issue end to end on a real 3.8 installation. They list a primary score of 7.2 and priority high, without reporting in-the-wild exploitation.
- Unrestricted banner upload in Maian Cart 3.8 (CWE-434).
- An uploaded PHP file can run as a webshell for OS commands.
- Researchers verified the issue on a real 3.8 installation.
- Primary score listed as 7.2 with priority high.
- Vendors
- Maian Media
- Products
- Maian Cart
- Organizations
- 0day Rubbish Research TeamMaian Media
From the original article
Posted by disclosure via Fulldisclosure on Oct 06 0day Rubbish Research Team is publicly disclosing a vulnerability in Maian Cart 3. 8, the self-hosted PHP shopping-cart system from Maian Media (Maian Script World), verified end to end against a real installation of that version.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.