Description

Zen Cart 1.3.8a, 1.3.8, and earlier does not require administrative authentication for admin/sqlpatch.php, which allows remote attackers to execute arbitrary SQL commands via the query_string parameter in an execute action, in conjunction with a PATH_INFO of password_forgotten.php, related to a "SQL Execution" issue.

Remediation

References

CVE-2009-2254

Related Vulnerabilities

WordPress Plugin Deeper Comments Security Bypass (2.1.1)

Moodle Permissions, Privileges, and Access Controls Vulnerability (CVE-2014-0124)

CakePHP Improper Input Validation Vulnerability (CVE-2010-4335)

SugarCRM Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2020-28956)

Joomla! Core 4.x.x Multiple Vulnerabilities (4.0.0 - 4.2.6)

Severity

High

Classification

CVE-2009-2254 CWE-138

Tags

Missing Update Known Vulnerabilities