Description
Multiple eval injection vulnerabilities in iGeneric iG Shop 1.0 allow remote attackers to execute arbitrary code via the action parameter, which is supplied to an eval function call in (1) cart.php and (2) page.php. NOTE: a later report and CVE analysis indicate that the vulnerability is present in 1.4.
Exploits (1)
exploitdb
WORKING POC
VERIFIED
by Michael Brooks · textwebappsphp
https://www.exploit-db.com/exploits/3083
References (11)
Core 11
Core References
Third Party Advisory, VDB Entry vdb-entry
x_refsource_bid
http://www.securityfocus.com/bid/21875
Exploit, Third Party Advisory exploit
x_refsource_exploit-db
https://www.exploit-db.com/exploits/3083
Third Party Advisory, VDB Entry vdb-entry
x_refsource_osvdb
http://osvdb.org/33388
Third Party Advisory, VDB Entry vdb-entry
x_refsource_osvdb
http://osvdb.org/33387
Third Party Advisory, VDB Entry mailing-list
x_refsource_bugtraq
http://www.securityfocus.com/archive/1/471722/100/0/threaded
Vendor Advisory third-party-advisory
x_refsource_secunia
http://secunia.com/advisories/23604
Third Party Advisory, VDB Entry mailing-list
x_refsource_bugtraq
http://www.securityfocus.com/archive/1/456043/100/0/threaded
Vendor Advisory vdb-entry
x_refsource_vupen
http://www.vupen.com/english/advisories/2007/0056
Third Party Advisory, VDB Entry vdb-entry
x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/31301
Third Party Advisory mailing-list
x_refsource_vim
http://www.attrition.org/pipermail/vim/2007-June/001664.html
Exploit x_refsource_misc
http://packetstormsecurity.nl/0701-exploits/igshop10-multiple.txt
Scores
EPSS
0.1414
EPSS Percentile
94.4%
Details
CWE
CWE-94
Status
published
Products (2)
igeneric/ig_shop
1.0
igeneric/ig_shop
1.4
Published
Jan 09, 2007
Tracked Since
Feb 18, 2026