Local File Inclusion Vulnerability in Zen Cart by Zen Cart Team
CVE-2024-5762

8.1HIGH

Key Information:

Vendor

Zen Cart

Status
Zen Cart
Vendor
CVE Published:
21 August 2024

What is CVE-2024-5762?

The Local File Inclusion vulnerability in Zen Cart is rooted in the findPluginAdminPage function, which fails to validate user-supplied data effectively before it is processed by a PHP include function. This vulnerability allows malicious actors to execute arbitrary code on compromised installations of Zen Cart without needing authentication. Attackers can exploit this flaw, possibly in conjunction with other security weaknesses, to execute code within the service account's context, posing a significant risk to data integrity and system security.

Affected Version(s)

Zen Cart 1.5.8a

References

https://www.zerodayinitiative.com/advisories/ZDI-24-883/
x_research-advisory
https://docs.zen-cart.com/release/whatsnew_2.0.0
vendor-advisory

EPSS Score

71% chance of being exploited in the next 30 days.

CVSS V3.1

Score:
8.1
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

CVSS V3.0

Score:
8.1
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

.