CVE

Id
39689  
CVE No.
CVE-2009-2254  
Status
Candidate  
Description
Zen Cart 1.3.8a, 1.3.8, and earlier does not require administrative authentication for admin/sqlpatch.php, which allows remote attackers to execute arbitrary SQL commands via the query_string parameter in an execute action, in conjunction with a PATH_INFO of password_forgotten.php, related to a "SQL Execution" issue.  
Phase
Assigned (20090629)  
Votes
None (candidate not yet proposed)  
Comments
 

Actions

Related CVE References

Id CVE Id CVE No. Reference Actions
436256 39689 CVE-2009-2254 MILW0RM:9005  View
436257 39689 CVE-2009-2254 URL:http://www.milw0rm.com/exploits/9005  View
436258 39689 CVE-2009-2254 CONFIRM:http://www.zen-cart.com/forum/attachment.php?attachmentid=5965  View
436259 39689 CVE-2009-2254 CONFIRM:http://www.zen-cart.com/forum/showthread.php?t=130161  View
436260 39689 CVE-2009-2254 BID:35468  View
436261 39689 CVE-2009-2254 URL:http://www.securityfocus.com/bid/35468  View
436262 39689 CVE-2009-2254 OSVDB:55343  View
436263 39689 CVE-2009-2254 URL:http://www.osvdb.org/55343  View
436264 39689 CVE-2009-2254 SECUNIA:35550  View
436265 39689 CVE-2009-2254 URL:http://secunia.com/advisories/35550  View
436266 39689 CVE-2009-2254 XF:zencart-sqlpatch-sql-injection(51317)  View

Related JVN

Id JVN No. Title Summary CVE No. CVE Id CVSS_v2 CVSS_v3 JVN URL Actions
43766 JVNDB-2009-004773 Netgear DG632 上で稼動する管理 Web インターフェースにおけるディレクトリトラバーサルの脆弱性 Netgear DG632 上で稼動する管理 Web インターフェースの cgi-bin/webcm には、ディレクトリトラバーサルの脆弱性が存在します。 CVE-2009-2258 39689 7.8 http://jvndb.jvn.jp/ja/contents/2009/JVNDB-2009-004773.html  View