| ID | CVE-2009-2255 | ||||||
| Sažetak | Zen Cart 1.3.8a, 1.3.8, and earlier does not require administrative authentication for admin/record_company.php, which allows remote attackers to execute arbitrary code by uploading a .php file via the record_company_image parameter in conjunction with a PATH_INFO of password_forgotten.php, then accessing this file via a direct request to the file in images/. | ||||||
| Reference |
|
||||||
| CVSS |
|
||||||
| Pristup |
|
||||||
| Impact |
|
||||||
| CVSS vektor | AV:N/AC:M/Au:N/C:P/I:P/A:P | ||||||
| Zadnje važnije ažuriranje | 19-09-2017 - 01:29 | ||||||
| Objavljeno | 30-06-2009 - 10:30 |
