CVE-2009-2255

Severity: medium (CVSS 6.8 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 31.0% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2009-06-30 · updated 2026-06-16
Weakness: CWE-287

Description

Zen Cart 1.3.8a, 1.3.8, and earlier does not require administrative authentication for admin/record_company.php, which allows remote attackers to execute arbitrary code by uploading a .php file via the record_company_image parameter in conjunction with a PATH_INFO of password_forgotten.php, then accessing this file via a direct request to the file in images/.

Affected products

Zen Cart: through 1.3.8a; 1.1.0, 1.1.3, 1.2.0d, 1.2.1d, 1.2.4d, 1.3.6 (+2)

References

http://secunia.com/advisories/35550
http://www.exploit-db.com/exploits/9004
http://www.osvdb.org/55344
http://www.securityfocus.com/bid/35467
http://www.zen-cart.com/forum/attachment.php?attachmentid=5965
http://www.zen-cart.com/forum/showthread.php?t=130161
https://exchange.xforce.ibmcloud.com/vulnerabilities/51316
http://secunia.com/advisories/35550
http://www.exploit-db.com/exploits/9004
http://www.osvdb.org/55344
http://www.securityfocus.com/bid/35467
http://www.zen-cart.com/forum/attachment.php?attachmentid=5965

Get alerted when CVE-2009-2255 or the next vulnerability affects your stack