Directory Traversal Vulnerability in Zen Cart by Zen Software
CVE-2008-6878

Currently unrated

Key Information:

Vendor: Zen Cart
Status: Zen Cart
Vendor: CVE Published:; 27 July 2009

What is CVE-2008-6878?

A directory traversal vulnerability exists in Zen Cart versions 1.3.8a, 1.3.8, and earlier. When .htaccess is not enforced, an attacker can exploit this flaw by manipulating the _SESSION[language] parameter. This manipulation allows the inclusion and execution of arbitrary local files, which could inadvertently expose sensitive file paths within the system. While the vendor has downplayed the severity of this issue, it remains crucial for users to apply necessary mitigations to safeguard their applications.

References

http://secunia.com/advisories/31039

third-party-advisoryx_refsource_SECUNIA

http://www.attrition.org/pipermail/vim/2008-July/002028.html

mailing-listx_refsource_VIM

http://www.zen-cart.com/forum/showthread.php?t=102802

x_refsource_MISC

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability published
Jul 27, 2009
Vulnerability Reserved
Jul 27, 2009

CVE-2008-6878 Data

JSON