Zen Cart 'extras/curltest.php' Information Disclosure Vulnerability

Zen Cart is prone to an information-disclosure vulnerability because it fails to sufficiently sanitize user-supplied data. An attacker can exploit this issue to view local files in the context of the webserver process. This may allow the attacker to obtain sensitive information; other attacks are...

CVE-2009-4321: Improper Input Validation

extras/curltest.php in Zen Cart 1.3.8 and 1.3.8a, and possibly other versions, allows remote attackers to read arbitrary files via a file:// URI. NOTE: some of these details are obtained from third party information...

Zen Cart extras/curltest.php Information Disclosure

The installed version of Zen Cart includes a test script, 'extras/curltest.php', intended for testing that the curl PHP library is installed and working properly. It fails, though, to restrict access and can be abused to access arbitrary URLs, including local files via the 'file' protocol handler...