CVE-2007-2424

The Merchant 2.2 - Remote File Inclusion via help/index.php show Parameter

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2007-2424. PoCs published by kezzap66345.

AI-analyzed exploit summary This is a client-side HTML/JavaScript exploit for a remote file inclusion (RFI) vulnerability in The Merchant Project. It constructs a malicious URL to include a remote shell script via the 'show' parameter in index.php.

Description

PHP remote file inclusion vulnerability in help/index.php in The Merchant (themerchant) 2.2 allows remote attackers to execute arbitrary PHP code via a URL in the show parameter.

Exploits (1)

exploitdb WORKING POC VERIFIED

by kezzap66345 · htmlwebappsphp

https://www.exploit-db.com/exploits/3818

View Code ZIP pw:eip

This is a client-side HTML/JavaScript exploit for a remote file inclusion (RFI) vulnerability in The Merchant Project. It constructs a malicious URL to include a remote shell script via the 'show' parameter in index.php.

Classification

Working Poc 90%

Attack Type

Rce

Complexity

Trivial

Reliability

Reliable

Target: The Merchant Project 2.2

No auth needed

Prerequisites: Victim must visit the malicious HTML page · Remote shell script must be accessible

MITRE ATT&CK