CVE

Id
36994  
CVE No.
CVE-2008-6877  
Status
Candidate  
Description
** DISPUTED ** Directory traversal vulnerability in admin/includes/initsystem.php in Zen Cart 1.3.8 and 1.3.8a, when .htaccess is not supported, allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the loader_file parameter. NOTE: the vendor disputes this issue, stating "at worst, the use of this vulnerability will reveal some local file paths."  
Phase
Assigned (20090727)  
Votes
None (candidate not yet proposed)  
Comments
 

Actions

Related CVE References

Id CVE Id CVE No. Reference Actions
402300 36994 CVE-2008-6877 MILW0RM:6038  View
402301 36994 CVE-2008-6877 URL:http://www.milw0rm.com/exploits/6038  View
402302 36994 CVE-2008-6877 MISC:http://www.zen-cart.com/forum/showthread.php?t=102802  View
402303 36994 CVE-2008-6877 VIM:20080711 Zen Cart 1.3.8 Multiple Local File Inclusion Vulnerabilities  View
402304 36994 CVE-2008-6877 URL:http://www.attrition.org/pipermail/vim/2008-July/002028.html  View
402305 36994 CVE-2008-6877 BID:30179  View
402306 36994 CVE-2008-6877 URL:http://www.securityfocus.com/bid/30179  View
402307 36994 CVE-2008-6877 OSVDB:46912  View
402308 36994 CVE-2008-6877 URL:http://osvdb.org/46912  View
402309 36994 CVE-2008-6877 SECUNIA:31039  View

Related JVN

Id JVN No. Title Summary CVE No. CVE Id CVSS_v2 CVSS_v3 JVN URL Actions
43304 JVNDB-2009-004311 Joomla! 用の livechat コンポーネントにおける SQL インジェクションの脆弱性 Joomla! 用の Live Chat (com_livechat) コンポーネントには、SQL インジェクションの脆弱性が存在します。 CVE-2008-6881 36994 7.5 http://jvndb.jvn.jp/ja/contents/2009/JVNDB-2009-004311.html  View