VULNERABILITY INTELLIGENCE

CVE-2009-2255

CVSS score6.8 MEDIUM
EPSS probability30.97%
CISA KEVNot currently listed
Published2009-06-30
Last modified2026-06-16
CVSS vectorAV:N/AC:M/Au:N/C:P/I:P/A:P

Description

Zen Cart 1.3.8a, 1.3.8, and earlier does not require administrative authentication for admin/record_company.php, which allows remote attackers to execute arbitrary code by uploading a .php file via the record_company_image parameter in conjunction with a PATH_INFO of password_forgotten.php, then accessing this file via a direct request to the file in images/.

Weakness classification

  • CWE-287: Improper Authentication

Primary references