Critical severityNVD Advisory· Published Sep 16, 2025· Updated Apr 15, 2026

CVE-2009-20006

Description

osCommerce versions up to and including 2.2 RC2a contain a vulnerability in its administrative file manager utility (admin/file_manager.php). The interface allows file uploads and edits without sufficient input validation or access control. An unauthenticated attacker can craft a POST request to upload a .php file containing arbitrary code, which is then executed by the server.

Affected products

OsCommerce/Oscommerce2 2inferred
Range: <=2.2 RC2a

Patches

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/unix/webapp/oscommerce_filemanager.rbnvd
www.exploit-db.com/exploits/16899nvd
www.exploit-db.com/exploits/9556nvd
www.oscommerce.comnvd
www.vulncheck.com/advisories/oscommerce-arbitrary-php-code-executionnvd

News mentions

No linked articles in our index yet.

cvss	0.585
epss	0.059
exploit	0.030
kev	0.000
patch	0.000
ransomware	0.000