Headline

CVE-2022-26521: 0days/Exploit.txt at main · sartlabs/0days

Abantecart through 1.3.2 allows remote authenticated administrators to execute arbitrary code by uploading an executable file, because the Catalog>Media Manager>Images settings can be changed by an administrator (e.g., by configuring .php to be a valid image file type).

2 years ago

CVE

Open in Source

#web #linux #debian #php #rce #auth

Permalink

Cannot retrieve contributors at this time

# Exploit Title: Authenticated Remote Code Execution in Abantecart-1.3.2

# Remote Code Execution in Abantecart-1.3.2 and earlier allows remote attackers to execute arbitrary code via uploading a php web shell. Abantecart-1.3.2 and earlier allows remote authenticated administrators to execute arbitrary code by uploading an executable file, because the Uploadable File Types setting can be changed by an administrator.

# Exploit Author: Sarang Tumne @CyberInsane (Twitter: @thecyberinsane) #HTB profile: https://www.hackthebox.com/home/users/profile/2718

# Date: 3rd Mar’2022

# CVE ID: CVE-2022-26521

# Confirmed on release 1.3.2

# Vendor: https://www.abantecart.com/download

###############################################

#Step1- Login with Admin Credentials

#Step2- Uploading .php files is disabled by default hence we need to abuse the functionality:

Goto Catalog=>Media Manager=>Images=>Edit=> Add php in Allowed file extensions

#Step3- Now Goto Add Media=>Add Resource=> Upload php web shell

#Step4- Copy the Resource URL location and execute it in the browser e.g. :

Visit //IP_ADDR/resources/image/18/7a/4.php (Remove the //) and get the reverse shell: