CVE-2007-4933 describes a direct static code injection vulnerability in Shop-Script FREE 2.0 and earlier, specifically within the includes/admin/sub/conf_appearence.php component. This flaw allows unauthenticated remote attackers to inject arbitrary PHP code into the cfg/appearence.inc.php file by manipulating parameters like productscount, colscount, and darkcolor via the save_appearence action in admin.php. The vulnerability carries a CVSS score of 7.5 (High), indicating a significant risk. It is easily exploitable over the network with low attack complexity and no authentication required, potentially leading to partial compromise of confidentiality, integrity, and availability. The FAUCET Risk Score of 90/100 further emphasizes its severity. While not listed on the CISA KEV catalog and lacking Metasploit or Nuclei modules, an exploit for remote command execution is available on ExploitDB. Despite this, there is no recorded community discussion or media coverage, suggesting it has not garnered widespread public attention or active exploitation in the wild.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
2.0CPE matchmatch criteria | cpe:2.3:a:shop-script:shop-script:2.0:*:*:*:*:*:*:* |
CVSS version used by this source: 2.0
AV:N/AC:L/Au:N/C:P/I:P/A:P
No social media mentions found for this CVE.
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.