NetSight
IP …
medium6.8Public exploit code

CVE-2009-2255

Zen Cart 1.3.8a, 1.3.8, and earlier does not require administrative authentication for admin/record_company.php, which allows remote attackers to execute arbit…

Public exploit code

Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.

Impact

Zen Cart 1.3.8a, 1.3.8, and earlier does not require administrative authentication for admin/record_company.php, which allows remote attackers to execute arbitrary code by uploading a .php file via the record_company_image parameter in conjunction with a PATH_INFO of password_forgotten.php, then accessing this file via a direct request to the file in images/.

Affected products

VendorProductAffected versions
Zen-CartZen Cart
through 1.3.8a
Versions 1.1.0, 1.1.3, 1.2.0d, 1.2.1d, 1.2.4d

Weakness classification

CWE-287

References