Zen Cart 'record_company.php' Remote Code Execution Vulnerability

Bugtraq ID:	35467
Class:	Input Validation Error
CVE:	CVE-2009-2255
Remote:	Yes
Local:	No
Published:	Jun 23 2009 12:00AM
Updated:	Apr 13 2015 09:09PM
Credit:	BlackH
Vulnerable:	Zen Ventures Zen Cart 1.3.8
Not Vulnerable:

Zen Cart 'record_company.php' Remote Code Execution Vulnerability

Zen Cart is prone to a remote code-execution vulnerability because the software fails to adequately sanitize user-supplied input.

Exploiting this issue could allow an attacker to execute arbitrary code within the context of the webserver process.

Note that the issue occurs only when the 'admin' directory wasn't properly renamed during the installation process.

Zen Cart 1.3.8 is vulnerable; other versions may also be affected.

Zen Cart 'record_company.php' Remote Code Execution Vulnerability

An attacker can use a browser to exploit this issue.

Core Security Technologies has developed a working commercial exploit for its CORE IMPACT product. This exploit is not otherwise publicly available or known to be circulating in the wild.

The following exploit code is available:

• /data/vulnerabilities/exploits/35467.php

Zen Cart 'record_company.php' Remote Code Execution Vulnerability

Solution:
The vendor has released a fix. Please see the references for details.

Zen Cart 'record_company.php' Remote Code Execution Vulnerability

References:

• Security Announcement (Zen Cart)
  
• Zen Cart Homepage (Zen Cart)