| 제목 | SourceCodester eCommerce 9c69f4d Unrestricted Upload of File with Dangerous Type |
|---|
| 설명 | SourceCodester eCommerce (php-eCommerce, commit 9c69f4d) allows unauthenticated remote code execution. admin/products/controller.php contains zero session or authorization checks (its sibling admin/user/controller.php has the guard; this file was missed). doInsert(), reachable via ?action=add, validates the uploaded image with only getimagesize() and then calls move_uploaded_file() with the raw attacker-controlled filename into admin/products/uploaded_photos/. An unauthenticated attacker uploads a GIF89a+PHP polyglot named shell.php that passes the image check and executes on request; live reproduction returned uid=0(root). The same unguarded controller also allows pre-auth product edit (?action=edit) and delete (?action=delete). CVSS 3.1 score 9.8 Critical, vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. Discovered by Santhosh Kumar, TraceX Labs. Vendor contact attempted via SourceCodester contact form (blocked by spam filter); public disclosure published at https://tracexlabs.com/releases/ecommerce-polyglot-rce.html. |
|---|
| 원천 | ⚠️ https://tracexlabs.com/releases/ecommerce-polyglot-rce.html |
|---|
| 사용자 | SanthoshKumar (UID 101638) |
|---|
| 제출 | 2026. 09. 25. PM 04:09 (1 월 ago) |
|---|
| 모더레이션 | 2026. 10. 12. PM 10:58 (17 days later) |
|---|
| 상태 | 중복 |
|---|
| VulDB 항목 | 275568 [SourceCodester E-Commerce System 1.0 controller.php photo 권한 상승] |
|---|
| 포인트들 | 0 |
|---|