← back
CVE-2009-2255

CVE-2009-2255

EPSS 31.0%
Zen Cart 1.3.8a, 1.3.8, and earlier does not require administrative authentication for admin/record_company.php, which allows remote attackers to execute arbitrary code by uploading a .php file via the record_company_image parameter in conjunction with a PATH_INFO of password_forgotten.php, then accessing this file via a direct request to the file in images/.
Affected products
n/a · n/a
public PoCs found — 2
cve_referencewww.exploit-db.com/exploits/9004unverifiedexploitdbwww.exploit-db.com/exploits/9004unverified
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →
References
http://secunia.com/advisories/35550https://exchange.xforce.ibmcloud.com/vulnerabilities/51316http://www.exploit-db.com/exploits/9004http://www.osvdb.org/55344http://www.securityfocus.com/bid/35467http://www.zen-cart.com/forum/attachment.php?attachmentid=5965http://www.zen-cart.com/forum/showthread.php?t=130161