vulnwire
7.5high

CVE-2007-0134in critical feed1 exploit

Multiple eval injection vulnerabilities in iGeneric iG Shop 1.0 allow remote attackers to execute arbitrary code via the action parameter,…

Published 19 y ago · modified 4 mo ago · JSON

CVSS
7.5
v2.0 · NVD
CISA KEV
No
not known exploited
EPSS
11.7%
percentile 96%
Public exploits
1
Exploit-DB

Multiple eval injection vulnerabilities in iGeneric iG Shop 1.0 allow remote attackers to execute arbitrary code via the action parameter, which is supplied to an eval function call in (1) cart.php and (2) page.php. NOTE: a later report and CVE analysis indicate that the vulnerability is present in 1.4.

Exploit prediction (EPSS)

11.70% probability of exploitation in the next 30 days, higher than 96% of all scored CVEs.

Exploits and detections

  • EDB-3083 ig shop 1.0 - Code Execution / SQL Injection · webapps · 2007-01-05

CVSS scores

Assigned byVersionScoreVector
NVD2.07.5AV:N/AC:L/Au:N/C:P/I:P/A:P

Classification

Weakness
  • CWE-94 Improper Control of Generation of Code

References

  • securityfocus.com /bid/21875 · vdb-entry, x_refsource_BID, x_transferred
  • exploit-db.com /exploits/3083 · exploit, x_refsource_EXPLOIT-DB, x_transferred
  • osvdb.org /33388 · vdb-entry, x_refsource_OSVDB, x_transferred
  • osvdb.org /33387 · vdb-entry, x_refsource_OSVDB, x_transferred
  • securityfocus.com /archive/1/471722/100/0/threaded · mailing-list, x_refsource_BUGTRAQ, x_transferred
  • secunia.com /advisories/23604 · third-party-advisory, x_refsource_SECUNIA, x_transferred
  • securityfocus.com /archive/1/456043/100/0/threaded · mailing-list, x_refsource_BUGTRAQ, x_transferred
  • vupen.com /english/advisories/2007/0056 · vdb-entry, x_refsource_VUPEN, x_transferred
  • exchange.xforce.ibmcloud.com /vulnerabilities/31301 · vdb-entry, x_refsource_XF, x_transferred
  • attrition.org /pipermail/vim/2007-June/001664.html · mailing-list, x_refsource_VIM, x_transferred
  • packetstormsecurity.nl /0701-exploits/igshop10-multiple.txt · x_refsource_MISC, x_transferred

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.