Blog Botz OpenCart Module Unrestricted File Upload Vulnerability

A critical vulnerability allowing unrestricted file uploads has been identified in the Blog Botz module for OpenCart, version 1.0. The issue arises in the file '/index.php?route=extension/module/blog_add', where the 'image' parameter can be manipulated to upload files of arbitrary types. This vulnerability can be exploited remotely, potentially leading to unauthorized access to the site's hosting environment. An attacker could upload a malicious PHP file, such as a web shell, and execute it on the server. This exploitation could result in a complete compromise of the site, including access to admin credentials and sensitive database information, such as payment details or Personally Identifiable Information.

Impact

Exploitation of this vulnerability could allow an unauthenticated attacker to upload malicious files to the server, potentially leading to a full compromise of the affected OpenCart site. Uploaded files could include web shells or other scripts that, once executed, could manipulate the site or access sensitive information, such as admin credentials or payment details stored in the site's database.

Reproduction

The vulnerability can be reproduced by sending a POST request to '/index.php?route=extension/module/blog_add' with the 'image' parameter containing a URL to a malicious file, such as a PHP script. The file will be uploaded to a location accessible via the web server, where it can be executed. This exploitation does not require authentication.

Remediation

The module should be updated to require authentication for file uploads and to validate that uploaded files are legitimate images before allowing them to be saved to a publicly accessible location. Additionally, web server configurations should be adjusted to prevent the execution of PHP scripts in directories where file uploads are permitted.