Unrated severityNVD Advisory· Published Jun 30, 2009· Updated Jun 16, 2026
CVE-2009-2254
CVE-2009-2254
Description
Zen Cart 1.3.8a, 1.3.8, and earlier does not require administrative authentication for admin/sqlpatch.php, which allows remote attackers to execute arbitrary SQL commands via the query_string parameter in an execute action, in conjunction with a PATH_INFO of password_forgotten.php, related to a "SQL Execution" issue.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
10cpe:2.3:a:zen-cart:zen_cart:*:*:*:*:*:*:*:*+ 9 more
- cpe:2.3:a:zen-cart:zen_cart:*:*:*:*:*:*:*:*range: <=1.3.8a
- cpe:2.3:a:zen-cart:zen_cart:1.1.0:*:*:*:*:*:*:*
- cpe:2.3:a:zen-cart:zen_cart:1.1.3:*:*:*:*:*:*:*
- cpe:2.3:a:zen-cart:zen_cart:1.2.0d:*:*:*:*:*:*:*
- cpe:2.3:a:zen-cart:zen_cart:1.2.1d:*:*:*:*:*:*:*
- cpe:2.3:a:zen-cart:zen_cart:1.2.4d:*:*:*:*:*:*:*
- cpe:2.3:a:zen-cart:zen_cart:1.3.6:*:*:*:*:*:*:*
- cpe:2.3:a:zen-cart:zen_cart:1.3.7:*:*:*:*:*:*:*
- cpe:2.3:a:zen-cart:zen_cart:1.3.8:*:*:*:*:*:*:*
- (no CPE)range: <=1.3.8a
Patches
Vulnerability mechanics
References
7- www.zen-cart.com/forum/attachment.phpnvdPatchVendor Advisory
- www.zen-cart.com/forum/showthread.phpnvdPatch
- www.securityfocus.com/bid/35468nvdExploitPatch
- secunia.com/advisories/35550nvdVendor Advisory
- www.exploit-db.com/exploits/9005nvd
- www.osvdb.org/55343nvd
- exchange.xforce.ibmcloud.com/vulnerabilities/51317nvd
News mentions
0No linked articles in our index yet.