High severity8.8NVD Advisory· Published Jul 27, 2017· Updated Jun 17, 2026
CVE-2017-11675
CVE-2017-11675
Description
The traverseStrictSanitize function in admin_dir/includes/classes/AdminRequestSanitizer.php in ZenCart 1.5.5e mishandles key strings, which allows remote authenticated users to execute arbitrary PHP code by placing that code into an invalid array index of the admin_name array parameter to admin_dir/login.php, if there is an export of an error-log entry for that invalid array index.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
zencart/zencartPackagist | >= 0 | — |
Affected products
2Patches
Vulnerability mechanics
References
3- github.com/advisories/GHSA-c9r9-3h38-r7vjghsaADVISORY
- github.com/imp0wd3r/vuln-papers/tree/master/zencart-155e-auth-rcenvdThird Party AdvisoryWEB
- nvd.nist.gov/vuln/detail/CVE-2017-11675ghsaADVISORY
News mentions
0No linked articles in our index yet.