CVE-2015-9227 | BDVDB-2026-90129 Detail

Description#

PHP remote file inclusion vulnerability in the get_file function in upload/admin2/controller/report_logs.php in AlegroCart 1.2.8 allows remote administrators to execute arbitrary PHP code via a URL in the file_path parameter to upload/admin2.

Impact#

No impact statement in the source data.

Weaknesses#

No weakness recorded in the source data.

References#

http://seclists.org/fulldisclosure/2015/Nov/67
https://www.exploit-db.com/exploits/38728/
https://blog.curesec.com/article/blog/AlegroCart-128-LFIRFI-102.html
http://packetstormsecurity.com/files/134361/AlegroCart-1.2.8-Local-Remote-File-Inclusion.html

Exploit#

https://www.exploit-db.com/exploits/38728/

History#

Version 12017-09-11Record published in the CVE List.
Version 22024-09-16Most recent update recorded in the CVE List.