CVE-2004-2024

Zen Cart 1.1.4 prior to patch 2 contains debugging code in the Admin password retrieval path (password_forgotten.php) that can enable attackers to gain administrative privileges. The connected records confirm the product/version and the root cause as debugging code in the admin password recovery ...

CVE-2004-2023

SQL injection vulnerability in login.php in Zen Cart 1.1.2d, 1.1.4 before patch 1, and possibly other versions allows remote attackers to execute arbitrary SQL via the 1 adminname or 2 adminpass parameters...

CVE-2004-2025

SQL injection vulnerability in applicationtop.php for Zen Cart 1.1.3 before patch 2 may allow remote attackers to execute arbitrary SQL commands via the productsid parameter...

CVE-2004-2023

SQL injection vulnerability in login.php in Zen Cart 1.1.2d, 1.1.4 before patch 1, and possibly other versions allows remote attackers to execute arbitrary SQL via the 1 adminname or 2 adminpass parameters...

CVE-2004-2025

SQL injection vulnerability in applicationtop.php for Zen Cart 1.1.3 before patch 2 may allow remote attackers to execute arbitrary SQL commands via the productsid parameter...

CVE-2004-2024

The distribution of Zen Cart 1.1.4 before patch 2 includes certain debugging code in the Admin password retrieval functionality, which allows attackers to gain administrative privileges via passwordforgotten.php...

Zen Cart login.php SQL Injection Vulnerability

Overview: "Zen Cart™ truly is the art of e-commerce; a free, user-friendly, open source shopping cart system." Description: An input validation vulnerability has been reported in Zen Cart, allowing a remote user to inject SQL commands. The '/admin/login.php' file does not properly validate...

zen25-hole.txt

Date: Wed, 29 Jul 1998 18:02:07 +1100 From: Dave Cottle Subject: ALERT: security hole in zen 2.5 client for NT 4.0 This was passed to Novell last week. here are the details: Situation: NT 4.0 Workstation Service Pack 3 ZEN Client 2.5 installed connecting to a NW 4.11 server Security Hole: using t...