Hum... cpanel vulnerable for local command execution
well agora cart alow command execution on the server ... by the admin shoping cart. If someone disable shell access and don't want to have server compromis please disable agora shoping cart. any other solution ... mail to agora team.