CVE-2015-8352 Directory traversal vulnerability in Zen Cart 1.5.4 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the act parameter to ajax.php.
CriticalCVSS 9.8
EPSS 15.6%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
Directory traversal vulnerability in Zen Cart 1.5.4 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the act parameter to ajax.php.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| zen-cart zen cart | = 1.5.4 | No fix listed |
References
- 20151216 RCE in Zen Cart via Arbitrary File Inclusion exploit mailing-list third-party-advisory vdb-entry
- 39017 exploit third-party-advisory vdb-entry
- www.htbridge.com exploit patch technical-description third-party-advisory
- www.zen-cart.com patch release-notes vendor-advisory