Exploitation Summary
EIP tracks 1 public exploit for CVE-2007-2474. PoCs published by s3rv3r_hack3r.
AI-analyzed exploit summary This exploit demonstrates a remote file inclusion vulnerability in Sunshop 4 by manipulating the 'abs_path' parameter in 'payflow_pro.php' to include arbitrary remote files. The lack of input sanitization allows an attacker to execute remote code or perform other malicious actions.
Description
Multiple PHP remote file inclusion vulnerabilities in Turnkey Web Tools SunShop Shopping Cart 4.0 allow remote attackers to execute arbitrary PHP code via a URL in the abs_path parameter to (1) include/payment/payflow_pro.php, (2) global.php, or (3) libsecure.php, different vectors than CVE-2007-2070.
Exploits (1)
This exploit demonstrates a remote file inclusion vulnerability in Sunshop 4 by manipulating the 'abs_path' parameter in 'payflow_pro.php' to include arbitrary remote files. The lack of input sanitization allows an attacker to execute remote code or perform other malicious actions.