NVD

Id
49506  
Name
CVE-2009-2254  
Description
Zen Cart 1.3.8a, 1.3.8, and earlier does not require administrative authentication for admin/sqlpatch.php, which allows remote attackers to execute arbitrary SQL commands via the query_string parameter in an execute action, in conjunction with a PATH_INFO of password_forgotten.php, related to a "SQL Execution" issue.  
Reject
 
CVSS Version
2  
CVSS Score
7.5  
Severity
High  
CVSS Base Score
7.5  
CVSS Impact Subscore
6.4  
CVSS Exploit Subscore
10  
CVSS Vector
(AV:N/AC:L/Au:N/C:P/I:P/A:P)  
Pub Date
2017-01-07  
Published
2009-06-30  
Modified Date
2009-06-30  
Seq
2009-2254  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
250349 49506 CVE-2009-2254 9005  View
250350 49506 CVE-2009-2254 35468  View
250351 49506 CVE-2009-2254 http://www.zen-cart.com/forum/attachment.php?attachmentid=5965  View
250352 49506 CVE-2009-2254 http://www.zen-cart.com/forum/showthread.php?t=130161  View
250353 49506 CVE-2009-2254 zencart-sqlpatch-sql-injection(51317)  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
45108 JVNDB-2009-006115 Zen Cart における任意の SQL コマンドを実行される脆弱性 Zen Cart は、admin/sqlpatch.php に管理者認証を必要しない、および "SQL 実行" 問題の不備があるため、任意の SQL コマンドを実行される脆弱性が存在します。 CVE-2009-2254 39685 CVE-2009-2254 49506 7.5 http://jvndb.jvn.jp/ja/contents/2009/JVNDB-2009-006115.html 2009-06-21 2012-12-20 View