This exploit demonstrates an unauthenticated Local File Inclusion (LFI) vulnerability in CS-Cart by manipulating the 'classes_dir' parameter in the 'class.cs_phpmailer.php' file. The null byte (%00) truncation technique is used to bypass file extension restrictions and read arbitrary files.
Classification
Working Poc 90%
Target:
CS-Cart ver. 1.3.4
No auth needed
Prerequisites:
Access to the target CS-Cart instance · Knowledge of the CS-Cart installation path