CVE-2008-6878

Directory traversal vulnerability in admin/includes/languages/english.php in Zen Cart 1.3.8a, 1.3.8, and earlier, when .htaccess is not supported, allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the _SESSION[language] parameter. NOTE: the vendor disputes this issue, stating "at worst, the use of this vulnerability will reveal some local file paths.

CVSS v2.0

6.8 MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:P

EPSS

2.34% chance of exploitation in the next 30 days, 82th percentile

Published

2009-07-27

Updated

2024-08-07

Proof-of-concept exploits (1)

• https://www.exploit-db.com/exploits/6038

References

• CVE Record
• NVD entry

Related

• CVE-2008-6877
• CVE-2008-6880
• CVE-2008-6875
• CVE-2008-6881
• CVE-2008-6874
• CVE-2008-6882