CVE-2007-0134

iGeneric iG Shop 1.0 - Remote Code Execution via Action Parameter

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2007-0134. PoCs published by Michael Brooks.

AI-analyzed exploit summary This exploit demonstrates an eval injection vulnerability in ig-shop, allowing arbitrary PHP code execution via the 'action' parameter in cart.php and page.php. It also includes SQL injection examples to dump credit card numbers and user logins.

Description

Multiple eval injection vulnerabilities in iGeneric iG Shop 1.0 allow remote attackers to execute arbitrary code via the action parameter, which is supplied to an eval function call in (1) cart.php and (2) page.php. NOTE: a later report and CVE analysis indicate that the vulnerability is present in 1.4.

Exploits (1)

exploitdb WORKING POC VERIFIED
by Michael Brooks · textwebappsphp
https://www.exploit-db.com/exploits/3083

This exploit demonstrates an eval injection vulnerability in ig-shop, allowing arbitrary PHP code execution via the 'action' parameter in cart.php and page.php. It also includes SQL injection examples to dump credit card numbers and user logins.

Classification
Working Poc 90%
Attack Type
Rce
Complexity
Trivial
Reliability
Reliable
Target: ig-shop (version not specified)
No auth needed
Prerequisites: Access to the vulnerable ig-shop application
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (11)

Core 11
Core References
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/21875
Exploit, Third Party Advisory exploit x_refsource_exploit-db
https://www.exploit-db.com/exploits/3083
Third Party Advisory, VDB Entry vdb-entry x_refsource_osvdb
http://osvdb.org/33388
Third Party Advisory, VDB Entry vdb-entry x_refsource_osvdb
http://osvdb.org/33387
Third Party Advisory, VDB Entry mailing-list x_refsource_bugtraq
http://www.securityfocus.com/archive/1/471722/100/0/threaded
Vendor Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/23604
Third Party Advisory, VDB Entry mailing-list x_refsource_bugtraq
http://www.securityfocus.com/archive/1/456043/100/0/threaded
Vendor Advisory vdb-entry x_refsource_vupen
http://www.vupen.com/english/advisories/2007/0056
Third Party Advisory, VDB Entry vdb-entry x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/31301
Third Party Advisory mailing-list x_refsource_vim
http://www.attrition.org/pipermail/vim/2007-June/001664.html

Scores

EPSS 0.1133
EPSS Percentile 95.4%

Details

CWE
CWE-94
Status published
Products (2)
igeneric/ig_shop 1.0
igeneric/ig_shop 1.4
Published Jan 09, 2007
Tracked Since Feb 18, 2026