Zen Cart Insecure File and Programs Information Disclosure and Database Deletion Vulnerability

Bugtraq ID:	37397
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Nov 28 2009 12:00AM
Updated:	Dec 17 2009 11:23PM
Credit:	Reported by the vendor
Vulnerable:	Zen Cart Web Shopping Cart 1.3.8 Zen Cart Web Shopping Cart 1.3.7 Zen Cart Web Shopping Cart 1.3.6 Zen Cart Web Shopping Cart 1.3.5 Zen Cart Web Shopping Cart 1.3.2 Zen Cart Web Shopping Cart 1.2.7 Zen Cart Web Shopping Cart 1.2.6 d Zen Cart Web Shopping Cart 1.2 Zen Cart Web Shopping Cart 1.1.2 d Zen Cart Web Shopping Cart 1.3.8a Zen Cart Web Shopping Cart 1.3.8a Zen Cart Web Shopping Cart 1.3.0.2
Not Vulnerable:

Zen Cart Insecure File and Programs Information Disclosure and Database Deletion Vulnerability

Zen Cart is prone to a security vulnerability that may allow attackers to obtain sensitive information or delete the application's database.

An attacker can exploit this issue to view files in the context of the webserver process and delete the application's database. Successful exploits may lead to further attacks.

Zen Cart Insecure File and Programs Information Disclosure and Database Deletion Vulnerability

An attacker can exploit this issue via a browser.

Zen Cart Insecure File and Programs Information Disclosure and Database Deletion Vulnerability

Solution:
Updates are available. Please see the references for details.

Zen Cart Insecure File and Programs Information Disclosure and Database Deletion Vulnerability

References:

• Zen Cart Homepage (Zen Cart)