Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
6.8
CVE-2008-6806: 7Shop lets attackers run code via image upload
CVE-2008-6806 · published 17 years ago
Summary
The imageupload.php file in 7Shop versions 1.1 and earlier lets anyone upload files without proper checks. An attacker could place a malicious program in the images folder and then run it on the server, potentially taking control of the site. Update to a patched version or remove the unsafe upload feature and enforce file type restrictions.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| 7-shop | 7shop |
<= 1.1 0.9_beta 1.0 cpe:2.3:a:7-shop:7shop:*:*:*:*:*:*:*:* |
Original advisory text
Unrestricted file upload vulnerability in includes/imageupload.php in 7Shop 1.1 and earlier allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then ...
Unrestricted file upload vulnerability in includes/imageupload.php in 7Shop 1.1 and earlier allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in images/artikel/.
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker partial control (estimated)
Severity
6.8
Medium
Type
CWE-20Improper Input Validation
Timeline
Published12 May 2009
Updated31 Oct 2026
First seen29 Sep 2026
Sources
CVE-2008-6806 · NVD
Track software like this
Free during beta