Quick Cart 6.7 Shell Upload

`# Title : Authenticated Remote Code Execution & Shell Upload  
# Product : Quick Cart  
# Vendor : https://opensolution.org/  
# Affected Version : 6.7  
# Researcher : Eagle Eye  
# Tested on : Window & Linux  
# Date : 11/06/2024  
# Affected path : admin.php , core/common-admin.php, database/config.php  
# Affected function : saveVariables()  
# Report : Already contact the vendor but no response  
  
# Description : Unfiltered parameter that post into admin.php?p=tools-config override any  
$config key value cause to unwanted file inclusion and allowed file extension overriding  
lead to remote code execution.  
# Step to reproduce (Method 1)  
- login at admin.php  
- click Products and New Product from top navbar  
- On the right panel, choose add file  
- Upload malicious script with extension txt or any allowed extension like jpg  
- click setting on right above  
- click save and intercept the request  
- on body parameter, add &default_pages_template=../../files/yourmaliciousfile.txt and proceed  
# Step to reproduce (Method 2)  
- login at admin.php  
- click setting on right above  
- click save and intercept the request  
- on body parameter, add &allowed_extensions=php and proceed  
- click Products and New Product from top navbar  
- On the right panel, choose add file  
- And you can upload malicious script with extension php - You may find on path eg: http://website.com/files/shell.php  
`