CVE-2008-3769: PHP remote file inclusion vulnerability in admin/create_order_new.php in Freeway 1.4.1.171, when register_g...

Security readout for executives and security teams

Freeway eCommerce 1.4.1.171 can allow a remote attacker to make the application load PHP code from a supplied URL, but only when PHP register_globals is enabled. If reachable, this can become server-side code execution. The source bundle does not name a fixed version or confirm real-world exploitation. Exposure is most likely in legacy Freeway eCommerce 1.4.1.171 deployments where admin/create_order_new.php is web-reachable and PHP register_globals remains enabled. Modern PHP environments are less likely to meet that precondition, but old commerce sites may still carry risk. Treat internet-facing legacy Freeway installations as urgent to verify. The condition is specific, but successful exploitation could mean full application server compromise. Prioritize identifying exposed systems, disabling the risky PHP setting, and deciding whether the old platform should be upgraded, isolated, or retired. Mitigation focus: Check vendor guidance and changelog for the supported Freeway update or retirement path.; Disable PHP register_globals wherever still present.; Restrict access to the Freeway admin directory to trusted users or networks..

Prepared

Jun 28, 2026, 18:33 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.