Detections
Analytics
Zen Cart password_forgotten.php Admin Access Bypass
high Nessus Plugin ID 39501
Language:
Synopsis
The remote web server contains a PHP application that is susceptible to an authentication bypass.Description
The version of Zen Cart installed on the remote host is affected by a design error that allows a remote attacker to bypass authentication and gain access to the application's admin section by appending '/password_forgotten.php' to URLs. Successful exploitation of this vulnerability may lead to disclosure of sensitive information such as customer data, SQL injection attacks, or arbitrary code execution.Solution
Apply the patch referenced in the project's advisory.See Also
Plugin Details
Severity: High
ID: 39501
File Name: zencart_password_forgotten_bypass.nasl
Version: 1.22
Type: remote
Family: CGI abuses
Published: 6/24/2009
Updated: 4/11/2022
Configuration: Enable thorough checks
Supported Sensors: Nessus
Risk Information
VPR
Risk Factor: High
Score: 7.4
CVSS v2
Risk Factor: High
Base Score: 7.5
Temporal Score: 6.2
Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P
Vulnerability Information
CPE: cpe:/a:zen-cart:zen_cart
Required KB Items: www/zencart
Excluded KB Items: Settings/disable_cgi_scanning
Exploit Ease: No exploit is required
Exploited by Nessus: true
Exploitable With
CANVAS (CANVAS)
Core Impact
Elliot (Zen Cart 1.3.8a File Upload)
Reference Information
CVE: CVE-2009-2254, CVE-2009-2255