CVE-2007-4933 - CVE House
Back to Database
Status published High CVE-2007-4933

Direct static code injection vulnerability in includes/admin/sub/conf_appearence.php in Shop-Script FREE...

Vulnerability Description

Direct static code injection vulnerability in includes/admin/sub/conf_appearence.php in Shop-Script FREE 2.0 and earlier allows remote attackers to inject arbitrary PHP code into cfg/appearence.inc.php via a save_appearence action in admin.php, as demonstrated with the (1) productscount, (2) colscount, and (3) darkcolor parameters.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2007-4933

Credits & Attribution

No credits recorded in the NVD database.

References

More from shop-script

View All →
CVE-2009-2023
SQL injection vulnerability in index.php in Shop-Script Pro 2.12, when...
Medium 6.8
CVE-2008-0158
Directory traversal vulnerability in index.php in Shop-Script 2.0 and possibly...
Medium 5
CVE-2007-4932
admin.php in Shop-Script FREE 2.0 and earlier sends a redirect...
High 7.5
CVE-2007-2331
PHP remote file inclusion vulnerability in cart.php in Shop-Script 2.0...
High 7.5

Affected Vendor

shop-script

View all reports →

Affected Software

shop-script
Vulnerable Versions:
2.0

Timeline

Official Publish: September 18th, 2007
Last Modified: August 7th, 2024
Added to House: July 18th, 2026

CVSS Vectors

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.