I-Mall Commerce is susceptible to remote arbitrary command execution due to a lack of variable sanity checking.