CVE-2009-2255 Zen Cart 1.3.8a, 1.3.8, and earlier does not require administrative authentication for admin/record_company.php, which allows remote attackers to execute arbitrary code by uploading a .php file via th...
MediumCVSS 6.8
EPSS 31.0%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
Zen Cart 1.3.8a, 1.3.8, and earlier does not require administrative authentication for admin/record_company.php, which allows remote attackers to execute arbitrary code by uploading a .php file via the record_company_image parameter in conjunction with a PATH_INFO of password_forgotten.php, then accessing this file via a direct request to the file in images/.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| zen-cart zen cart | <= 1.3.8a | No fix listed |
| zen-cart zen cart | = 1.1.0 | No fix listed |
| zen-cart zen cart | = 1.1.3 | No fix listed |
| zen-cart zen cart | = 1.2.0d | No fix listed |
| zen-cart zen cart | = 1.2.1d | No fix listed |
| zen-cart zen cart | = 1.2.4d | No fix listed |
| zen-cart zen cart | = 1.3.6 | No fix listed |
| zen-cart zen cart | = 1.3.7 | No fix listed |
| zen-cart zen cart | = 1.3.8 | No fix listed |
References
- 35550 third-party-advisory vendor-advisory
- 9004 exploit
- 55344 vdb-entry
- 35467 exploit patch vdb-entry
- www.zen-cart.com patch
- www.zen-cart.com patch
- zencart-recordcompany-code-execution(51316) vdb-entry