ShopXO File Upload Vulnerability in ThemeDataService.php

A file upload vulnerability has been identified in ShopXO version 6.4.0, specifically within the ThemeDataService.php file. The issue arises because while the application checks file extensions, it fails to validate the actual content of the files being uploaded. This oversight allows for potentially malicious files to be uploaded and executed.

Impact

Exploitation of this vulnerability could lead to remote code execution, as uploaded files can be executed by the server.

Reproduction

To reproduce this vulnerability, upload a file with a checked extension (such as .html) that contains PHP code. The file will be executed on the server, demonstrating the vulnerability.

Remediation

It is recommended to implement a content filter for uploaded files to ensure that only safe, intended file types are allowed.