CVE-2004-0241

This exploit targets X-Cart's upgrade.php script, which fails to sanitize URI parameters. By manipulating the 'perl_binary' parameter, an attacker can execute arbitrary commands (e.g., '/bin/rm -rf') on the server.

This exploit leverages an unsanitized parameter in X-Cart's admin interface to inject arbitrary commands via the 'config[General][perl_binary]' parameter, leading to remote command execution (RCE). The PoC demonstrates command injection by appending a command to the intended binary path.