CVE-2008-6877: Path Traversal

Published Jul 27, 2009

Updated

DISPUTED Directory traversal vulnerability in admin/includes/initsystem.php in Zen Cart 1.3.8 and 1.3.8a, when .htaccess is not supported, allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the loaderfile parameter. NOTE: the vendor disputes this issue, stating "at worst, the use of this vulnerability will reveal some local file paths."

Affected Software

2 affected components

Zen Cart Zen Cart=1.3.8

Zen Cart Zen Cart=1.3.8a

Event History

Jul 27, 2009

CVE Published

via MITRE·02:22 PM

Data Sourced

via MITRE·02:22 PM

Description

Disputed

02:30 PM

Frequently Asked Questions

What is the severity of CVE-2008-6877?

CVE-2008-6877 has been classified as a medium severity vulnerability due to its potential for remote code execution.

How do I fix CVE-2008-6877?

To mitigate CVE-2008-6877, users should upgrade to a newer version of Zen Cart that addresses this vulnerability.

What are the affected versions in CVE-2008-6877?

CVE-2008-6877 affects Zen Cart versions 1.3.8 and 1.3.8a.

Can CVE-2008-6877 be exploited without .htaccess support?

Yes, CVE-2008-6877 specifically allows exploitation when .htaccess is not supported.

What type of vulnerability is CVE-2008-6877?

CVE-2008-6877 is a directory traversal vulnerability that allows remote attackers to include arbitrary local files.