Description
Wordpress e-Commerce Plugin 3.4版本及其早期版本的image_processing.php中存在无限制文件上传漏洞。远程攻击者可以借助上传一个具有可执行扩展名的文件并对wp-content/plugins/wp-shopping-cart/中的文件提交一个直接的请求来访问该文件，以执行任意代码。
Instinct WP e-Commerce 'image_processing.php'任意文件上传漏洞
PoC
None yet. Search at https://trap.biu.life/?ref=rssReferences
https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/wp-shopping-cart/instinct-wp-e-commerce-34-arbitrary-file-upload
https://www.exploit-db.com/exploits/6867
https://nvd.nist.gov/vuln/detail/CVE-2008-6811
https://exchange.xforce.ibmcloud.com/vulnerabilities/46224
https://www.invicti.com/web-application-vulnerabilities/wordpress-plugin-instinct-e-commerce-arbitrary-file-upload-3-4
https://vulmon.com/vulnerabilitydetails?qid=CVE-2008-6811
https://cve.imfht.com/detail/CVE-2008-6811?lang=en