https://www.exploit-db.com/exploits/37977
Catalog > Manage Products > Select a product > Edit > Custom Options > Add New Option
Input Type = File
Allowed File Extensions = .php
Save
Go to product page, select shell.php and add to cart > file is uploaded.
(Authenticated) https://www.exploit-db.com/exploits/37811