CVEvulnerability

CVE-2009-2255

6.8 MEDIUM Published 2009-06-30 Modified 2026-06-16 Official page ↗
Status
Modified
Published
2009-06-30
Last modified
2026-06-16
Assigner
[email protected]
CVSS 2.0 ([email protected])
6.8 MEDIUM — AV:N/AC:M/Au:N/C:P/I:P/A:P
Weaknesses
CWE-287

Description

Zen Cart 1.3.8a, 1.3.8, and earlier does not require administrative authentication for admin/record_company.php, which allows remote attackers to execute arbitrary code by uploading a .php file via the record_company_image parameter in conjunction with a PATH_INFO of password_forgotten.php, then accessing this file via a direct request to the file in images/.

Affected configurations

• zen-cart zen cart (<= 1.3.8a) • zen-cart zen cart 1.1.0 • zen-cart zen cart 1.1.3 • zen-cart zen cart 1.2.0d • zen-cart zen cart 1.2.1d • zen-cart zen cart 1.2.4d • zen-cart zen cart 1.3.6 • zen-cart zen cart 1.3.7 • zen-cart zen cart 1.3.8

Related

Weakness · CWE (1)

  • CWE-287 Improper Authentication weakness

References