PT-2004-2919 · Zen Cart · Zen Cart

Published 2004-12-31 · Updated 2018-10-19 · CVE-2004-2023

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Zen Cart versions 1.1.2d through 1.1.4 before patch 1

Description The issue allows remote attackers to execute arbitrary SQL commands. This is achieved via the admin name or admin pass parameters in the login.php file.

Recommendations For Zen Cart versions 1.1.2d through 1.1.4 before patch 1, apply patch 1 to resolve the issue.

Fix

Related Identifiers

CVE-2004-2023

Affected Products

Zen Cart

References · 12

• http://zen-cart.com/modules/mydownloads/viewcat.php?cid=31&orderby=dateD · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2004-2023 · Security Note
• http://zen-cart.com/modules/ipb/index.php?showtopic=4835 · Vendor Advisory
• http://secunia.com/advisories/11649 · Patch
• http://securitytracker.com/id?1010172 · Note
• http://securityfocus.com/archive/1/434237/30/4950/threaded · Note
• http://packetstormsecurity.org/0405-advisories/zencart112d.txt · Note
• http://securityfocus.com/bid/10378 · Note
• http://osvdb.org/6298 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/16176 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-2023 · Note
• http://marc.info/?l=bugtraq&m=108489697219781&w=2 · Note