CVE-2015-9227

HighCVSS 7.2/10Last modified Jun 17, 2026

Description

PHP remote file inclusion vulnerability in the get_file function in upload/admin2/controller/report_logs.php in AlegroCart 1.2.8 allows remote administrators to execute arbitrary PHP code via a URL in the file_path parameter to upload/admin2.

Metrics

CVSS 3.0 7.2/10CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-94

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://packetstormsecurity.com/files/134361/AlegroCart-1.2.8-Local-Remote-File-Inclusion.htmlExploit, Third Party Advisory, VDB Entry
http://seclists.org/fulldisclosure/2015/Nov/67Exploit, Mailing List, Third Party Advisory
https://blog.curesec.com/article/blog/AlegroCart-128-LFIRFI-102.htmlExploit, Third Party Advisory
https://www.exploit-db.com/exploits/38728/Exploit, Third Party Advisory, VDB Entry
http://packetstormsecurity.com/files/134361/AlegroCart-1.2.8-Local-Remote-File-Inclusion.htmlExploit, Third Party Advisory, VDB Entry
http://seclists.org/fulldisclosure/2015/Nov/67Exploit, Mailing List, Third Party Advisory
https://blog.curesec.com/article/blog/AlegroCart-128-LFIRFI-102.htmlExploit, Third Party Advisory
https://www.exploit-db.com/exploits/38728/Exploit, Third Party Advisory, VDB Entry

Timeline

Published: Sep 11, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2015

CVE-2015-92288.8In post-new.php in the Photocrati NextGEN Gallery plugin 2.1.10 for WordPress, unrestricted file upload is available via the name parameter,CVE-2015-92294.8In the nggallery-manage-gallery page in the Photocrati NextGEN Gallery plugin 2.1.15 for WordPress, XSS is possible for remote authenticated CVE-2015-92304.8In the admin/db-backup-security/db-backup-security.php page in the BulletProof Security plugin before .52.5 for WordPress, XSS is possible f CVE-2015-92317.5iTerm2 3.x before 3.1.1 allows remote attackers to discover passwords by reading DNS queries. A new (default) feature was added to iTerm2 ve CVE-2015-92325.3The Good for Enterprise application 3.0.0.415 for Android does not use signature protection for its Authentication Delegation API intent. Al CVE-2015-92338.8The cp-contact-form-with-paypal (aka CP Contact Form with PayPal) plugin before 1.1.6 for WordPress has CSRF with resultant XSS, related to CVE-2015-92347.2The cp-contact-form-with-paypal (aka CP Contact Form with PayPal) plugin before 1.1.6 for WordPress has SQL injection via the cp_contactform CVE-2015-92359.8In jsonwebtoken node module before 4.2.2 it is possible for an attacker to bypass verification when a token digitally signed with an asymmet CVE-2015-92365.3Hapi versions less than 11.0.0 implement CORS incorrectly and allowed for configurations that at best returned inconsistent headers and at w CVE-2015-92385.3secure-compare 3.0.0 and below do not actually compare two strings properly. compare was actually comparing the first argument with itself, CVE-2015-92397.5ansi2html is vulnerable to regular expression denial of service (ReDoS) when certain types of user input is passed in.CVE-2015-92407.5Due to a bug in the the default sign in functionality in the keystone node module before 0.3.16, incomplete email addresses could be matched