CVE-2015-9227

High

Published: 11/09/2017(UTC)Translated: 15/06/2026(UTC)NVD NIST

Summary

CVE-2015-9227 in AlegroCart 1.2.8 has a remote file inclusion vulnerability in the get_file function, allowing remote administrators to execute arbitrary PHP code via a URL in the file_path parameter.

Risk Assessment

This vulnerability poses a serious security risk, enabling attackers to execute code remotely, potentially leading to system compromise.

Recommendation

It is recommended to update to the latest version of AlegroCart and implement appropriate security measures to mitigate the risk of remote code execution.

Other vulnerabilities in AlegroCart 1.2.8

CVE-2015-9226High
Multiple SQL injection vulnerabilities in AlegroCart 1.2.8 allow remote administrators and authenticated users to execute arbitrary SQL commands through specific parameters in download and order update functions.

Original NVD description (English source)

PHP remote file inclusion vulnerability in the get_file function in upload/admin2/controller/report_logs.php in AlegroCart 1.2.8 allows remote administrators to execute arbitrary PHP code via a URL in the file_path parameter to upload/admin2.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS