Code Execution Vulnerability in Zen Cart by Zen Cart
CVE-2009-2255
Currently unrated
Key Information:
Badges
👾 Exploit Exists🟡 Public PoC🟣 EPSS 30%
What is CVE-2009-2255?
Zen Cart versions 1.3.8a, 1.3.8, and earlier exhibit a significant vulnerability due to a lack of administrative authentication for the admin/record_company.php file. This flaw allows remote attackers to upload malicious PHP files via the record_company_image parameter when combined with a specific PATH_INFO value of password_forgotten.php. Once the arbitrary code is uploaded, it can be executed through direct access to the file within the images/ directory, potentially compromising the affected systems.
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.