[0day-rubbish] Maian Pal 2.1 product image upload with no extension allow-list to PHP webshell and www-data uid 33 code execution (7.2, PR:H)
Maian Pal 2.1 image uploads lack an extension allow-list, enabling PHP code execution.
The 0day Rubbish Research Team disclosed an unrestricted file-upload flaw in Maian Pal 2.1, a commercial self-hosted PHP shopping-cart script from UK vendor Maian Media. Product image uploads have no extension allow-list, so a PHP webshell can be stored and executed as www-data uid 33. Researchers cite CWE-434 as primary, with CWE-94 and CWE-693, and say they verified it on a real installation in three reproductions. The claimed score is 7.2; no CVE or in-the-wild exploitation is stated.
- Affects self-hosted Maian Pal 2.1 shopping cart.
- Product image upload lacks an extension allow-list.
- Uploaded PHP can run as www-data uid 33.
- Claimed score 7.2; reproduced on a real install.
- Vendors
- Maian Media
- Products
- Maian Pal
- Countries
- United Kingdom
From the original article
Posted by disclosure via Fulldisclosure on Oct 15 0day Rubbish Research Team is publicly disclosing a vulnerability in Maian Pal 2. 1, the self-hosted PHP shopping-cart script from Maian Media (United Kingdom), oriented at PayPal checkout and distributed as a commercial closed-source archive, verified end to end against a real installation of that version in three independent reproductions.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.