^{CVE-2008-6768:}Unrestricted file upload vulnerability in K&S Shopsoftware's admin/editor/images.php allows remote attackers to execute arbitrary PHP code by uploading a file with an executable extension and then accessing it directly via images/upload/.

Overview

This vulnerability is an unrestricted file upload in K&S Shopsoftware’s admin/editor/images.php that enables remote attackers to upload a scriptable file and trigger code execution by directly requesting the uploaded file from images/upload/, exposing the server to full compromise if not mitigated.

Remediation

• Update or patch to a vendor-fixed version of K&S Shopsoftware that addresses the unrestricted file upload vulnerability. If a patch is not available, implement mitigations immediately.
• Disable execution of uploaded files:
  • Store uploads outside the web root or in a directory with no execute permissions.
  • Configure the web server to disallow execution of files in the uploads directory (e.g., Apache: deny execution for the images/upload path; use .htaccess to disable PHP/CGI execution in that folder).
• Validate uploads strictly:
  • Implement a strict allowlist of file extensions (do not accept executable extensions like .php, .php5, .phtml, etc.).
  • Validate mime-type and content, not just file extension; sanitize and normalise file names to prevent path traversal and script execution.
  • Rename uploaded files to unique, non-executable names.
• Apply least privilege:
  • Ensure uploads directory permissions are restrictive (e.g., 0644 for files, 0755 for directories) and that the web server process does not run with higher-than-necessary privileges.
• Add server-side controls:
  • Enforce server-side checks for uploads (size limits, type checks) in the application logic.
  • Consider implementing additional security controls such as content scanning or anti-malware checks on uploads.
• Monitoring and logging:
  • Enable detailed logging of upload events and access to uploaded files; alert on anomalous upload activity.
• If feasible, remove the ability to upload executable content in the affected module or implement alternative upload mechanisms that do not place code that can be executed within the web root.

References

• OSVDB-51210: http://osvdb.org/51210
• Secunia Advisory 33212: http://secunia.com/advisories/33212
• BID-32888: http://www.securityfocus.com/bid/32888
• Exploit-DB 7500: https://www.exploit-db.com/exploits/7500
• XF vulnerability:shopsystemexclusivplus-images-file-upload(47424): https://exchange.xforce.ibmcloud.com/vulnerabilities/47424
• CVE-2008-6768: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-6768