https://www.exploit-db.com/exploits/21896
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200212-473

MidiCartPHP1版本存在漏洞。远程攻击者（1）借助admin/upload.php的直接请求上传任意php文件或者（2）借助admin/credit_card_info.php的直接请求访问敏感信息。

source: http://www.securityfocus.com/bid/5855/info

A problem with the default installation of Midicart PHP may make it possible for remote users to gain access to sensitive information.

The default installation of Midicart PHP does not place sufficient access control on files residing in the 'admin' folder. Due to this lack of access control, it is possible for a remote attacker to gain access to this file and upload arbitrary files to a vulnerable system.

http://<site>/admin/upload.php

来源:BID
名称:5855
链接:http://www.securityfocus.com/bid/5855
来源:BID
名称:5851
链接:http://www.securityfocus.com/bid/5851
来源:XF
名称:midicart-php-access-upload(10306)
链接:http://www.iss.net/security_center/static/10306.php
来源:BUGTRAQ
名称:20021002MultipleWebSecurityHoles
链接:http://archives.neohapsis.com/archives/bugtraq/2002-10/0016.html