PHP remote file inclusion vulnerability in config.php in Comdev eCommerce 3.0 allows remote attackers to execute arbitrary PHP code via the path[docroot] parameter.
https://exchange.xforce.ibmcloud.com/vulnerabilities/21733
http://www.securityfocus.com/bid/14478