Exploitation Summary
EIP tracks 1 public exploit for CVE-2009-2254. PoCs published by BlackH.
AI-analyzed exploit summary This exploit targets a SQL injection vulnerability in Zen Cart 1.3.8 via the admin/sqlpatch.php endpoint. It allows remote execution of arbitrary SQL queries by sending crafted requests to the vulnerable endpoint.
Description
Zen Cart 1.3.8a, 1.3.8, and earlier does not require administrative authentication for admin/sqlpatch.php, which allows remote attackers to execute arbitrary SQL commands via the query_string parameter in an execute action, in conjunction with a PATH_INFO of password_forgotten.php, related to a "SQL Execution" issue.
Exploits (1)
This exploit targets a SQL injection vulnerability in Zen Cart 1.3.8 via the admin/sqlpatch.php endpoint. It allows remote execution of arbitrary SQL queries by sending crafted requests to the vulnerable endpoint.