Media Manager in the admin panel allows admin user to upload XSS-able file

[Note: remember to include site URL, ZC version, list of plugins, PHP version, etc ... read the Posting Tips shown above for information to include in your post here. And, remove this comment before actually posting!]Hello,

I want to report the vulnerability that I found.

Detail is in the below.

1. Environment
   OS: Ubuntu 16.04.3 LTS
   Web Server : Apache/2.4.18 (Ubuntu)
   PHP : PHP 5.6.39-1+ubuntu16.04.1+deb.sury.org+1 (cli)
   (in default setting)

2. Root Cause

• In [admin directory]/media_manager.php script, Line Number 49~76 is executed when the user upload.

• This logic checks that uploaded file name have the extension following the media_type, but this logic didn't compare the extension with end of filename.

  If user decided the media_type as mp3, It can be bypassed with this file name : malmp3.m4v

• Also, This logic has the white list for allowed extensions, but the list provide the potential malicious extensions.
  ( Apache2 didn't provide the content-type header for below extension.)
  : epub, m4v

• Therefore, the html file that named "malmp3.m4v", "malmp3.epub" can be uploaded via media manager feature.

• If the file that has "HTML Contents" and epub or m4v extension is tried to upload these feature and is accessed directly, these files can be randered and executed in the client browser.

3. Reproduce

   a. Make the malicious file
   - file name : malmp3.m4v
   - file contents : <html><head></head><body><script>alert('xss');</script></body></html>
   b. Login to administrator panel and move to media manager ( admin panel > Extras > Media Manager )
   c. insert collection Name and click edit
   d. Upload the malicious file (generated in "a") and set the Media Clip Type as mp3 (it is default when the admin did not append the media type).
   e. It saved in '[zencart directory]/media/malmp3.m4v'. Try to access direct with URL
   (example : http://127.0.0.1/zencart/media/malmp3.m4v)

If you need to more information, please mail me or comment to the this post.

Thank you.