[0day-rubbish] Maian Pal 2.1 product image upload with no extension allow-list to PHP webshell and www-data uid 33 code execution (7.2, PR:H)

Kurzinfo

Metadaten

Original (extern): Link oeffnen
Veroeffentlicht: 2026-10-15 07:42 UTC
Importiert: 2026-10-20 19:12 UTC
Quelle-ID: full_disc
uid_hash: baf73b56ec106459464979b3b14cf3f4083b5e922774c7a48148f8ae5a7ceda1

Full Disclosure

Posted by disclosure via Fulldisclosure on Oct 15 0day Rubbish Research Team is publicly disclosing a vulnerability in Maian Pal

2.1, the self-hosted PHP shopping-cart script from Maian Media (United Kingdom),

oriented at PayPal checkout and distributed as a commercial closed-source archive,

verified end to end against a real installation of that version in three

independent reproductions.

Type: unrestricted upload of a file with a dangerous type (CWE-434 primary, with

CWE-94 and CWE-693...

No data

Bezeichnung	Name	Kategorie	Tags	Zielgruppe	Sprache	Feed-URL
Full Disclosure	full_disc	threat_intel		-	de	https://seclists.org/rss/fulldisclosure.rss