CVE-2004-2010: PHP remote file inclusion vulnerability in index.php in phpShop 0.7.1 and earlier allows remote attackers t...

Security readout for executives and security teams

CVE-2004-2010 affects legacy phpShop sites. A remote attacker could make the application load PHP code from an external server through the base_dir parameter, resulting in arbitrary code execution. The source bundle does not provide a CVSS score, confirmed patch, or active-exploitation evidence. Exposure is most likely on legacy, internet-facing phpShop 0.7.1 or earlier deployments. Organizations should focus on old PHP e-commerce systems, archived storefronts, forgotten virtual hosts, and inherited hosting accounts. Prioritize discovery and containment if phpShop exists in your environment. Although active exploitation is not shown here, the vulnerability enables server-side code execution in obsolete e-commerce software. Mitigation focus: Inventory phpShop deployments and identify versions at or below 0.7.1.; Check vendor or trusted advisory guidance for an official fixed version or workaround.; Retire or isolate unsupported phpShop installations if vendor guidance is unavailable..

Prepared

Jun 29, 2026, 21:12 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.