CVE:CVE-2007-4907
CNNVD:CNNVD-200709-193
X-Cart中的多个PHP远程文件包含漏洞允许远程攻击者可以借助(1) config.php, (2) prepare.php, (3) smarty.php, (4) customer/product.php, (5) provider/auth.php,以及admin/auth.php中的xcart_dir参数的一个URL执行任意PHP代码。
solution:Upgrade qualiteam x-cart to a higher version than 3.5.0,and avoid the version 3.5.0