CVE-2007-1127

shopkitplus - Directory Traversal via changetheme Parameter

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2007-1127. PoCs published by laurent gaffie.

AI-analyzed exploit summary The provided text describes a local file inclusion (LFI) vulnerability in Shop Kit Plus, where unsanitized user input allows directory traversal to access sensitive files like /etc/passwd. No actual exploit code is present, only a description and example URL.

Description

Directory traversal vulnerability in enc/stylecss.php in shopkitplus allows remote attackers to read arbitrary files via a .. (dot dot) in the changetheme parameter.

Exploits (1)

exploitdb WRITEUP VERIFIED

by laurent gaffie · textwebappsphp

https://www.exploit-db.com/exploits/29640

View Code ZIP pw:eip

The provided text describes a local file inclusion (LFI) vulnerability in Shop Kit Plus, where unsanitized user input allows directory traversal to access sensitive files like /etc/passwd. No actual exploit code is present, only a description and example URL.

Classification

Writeup 90%

Attack Type

Info Leak

Complexity

Trivial

Reliability

Theoretical

Target: Shop Kit Plus (version unspecified)

No auth needed

Prerequisites: Network access to the target application

devstral-2 · analyzed Feb 16, 2026 Full analysis →