Unrated severityNVD Advisory· Published Jul 27, 2009· Updated Apr 23, 2026
CVE-2008-6878
CVE-2008-6878
Description
Directory traversal vulnerability in admin/includes/languages/english.php in Zen Cart 1.3.8a, 1.3.8, and earlier, when .htaccess is not supported, allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the _SESSION[language] parameter. NOTE: the vendor disputes this issue, stating "at worst, the use of this vulnerability will reveal some local file paths.
Affected products
2Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
6- www.attrition.org/pipermail/vim/2008-July/002028.htmlnvdExploit
- www.securityfocus.com/bid/30179nvdExploit
- www.zen-cart.com/forum/showthread.phpnvdExploit
- secunia.com/advisories/31039nvdVendor Advisory
- osvdb.org/46913nvd
- www.exploit-db.com/exploits/6038nvd
News mentions
0No linked articles in our index yet.