Laravel-based xShop RCE via File Upload

xShop, an open-source e-commerce platform built on Laravel, is affected.

An authenticated administrator can exploit an Unrestricted File Upload vulnerability in version 3.0.3 to upload executable files like .php.

Uploading a specially crafted PHP file allows an attacker to achieve Remote Code Execution (RCE), potentially leading to a full system compromise.

Version 3.0.4 addresses this issue.