Lucene search
MitreCVELIST:CVE-2009-2255HistoryJun 30, 2009 - 10:00 a.m.
CVE-2009-2255
2009-06-3010:00:00
mitre
www.cve.org
3
Zen Cart 1.3.8a, 1.3.8, and earlier does not require administrative authentication for admin/record_company.php, which allows remote attackers to execute arbitrary code by uploading a .php file via the record_company_image parameter in conjunction with a PATH_INFO of password_forgotten.php, then accessing this file via a direct request to the file in images/.
Related
canvas
canvas
Immunity Canvas: ZENCART_REMOTE
2009-06-30 10:30:00
prion
prion
Design/Logic Flaw
2009-06-30 10:30:00
exploitdb
exploitdb
Zen Cart 1.3.8 - Remote Code Execution
2009-06-23 00:00:00
seebug
seebug
Zen Cart record_company.php樑εθΏη¨δ»£η ζ§θ‘ζΌζ΄
2009-09-05 00:00:00
cve
cve
CVE-2009-2255
2009-06-30 10:30:19
dsquare
dsquare
Zen Cart 1.3.8a File Upload
2012-04-30 00:00:00
nvd
nvd
CVE-2009-2255
2009-06-30 10:30:19
nessus
nessus
Zen Cart password_forgotten.php Admin Access Bypass
2009-06-24 00:00:00
openvas
openvas
Zen Cart <= 1.3.8a Multiple Vulnerabilities
2009-07-03 00:00:00