This exploit leverages an arbitrary file upload vulnerability in LiteCart 2.1.2 by bypassing Content-Type restrictions to upload a malicious PHP file, achieving remote code execution. It authenticates as an admin, uploads a PHP shell disguised as an XML file, and executes commands via HTTP requests.
Classification
Working Poc 95%
Target:
LiteCart 2.1.2
Auth required
Prerequisites:
Admin credentials · Network access to the target · LiteCart 2.1.2 with vulnerable vqmods component