** DISPUTED ** Directory traversal vulnerability in admin/includes/languages/english.php in Zen Cart 1.3.8a, 1.3.8, and earlier, when .htaccess is not supported, allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the _SESSION[language] parameter. NOTE: the vendor disputes this issue, stating "at worst, the use of this vulnerability will reveal some local file paths."
Credit: cve@mitre.org
Affected Software
Affected Version
How to fix
Zen Cart
=1.3.8
Zen Cart
=1.3.8a
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
CVE-2008-6878 is considered a medium severity vulnerability due to its impact on file inclusion and arbitrary code execution.
How do I fix CVE-2008-6878?
To fix CVE-2008-6878, upgrade Zen Cart to the latest version that addresses this vulnerability or implement restrictions to prevent directory traversal.
What versions of Zen Cart are affected by CVE-2008-6878?
CVE-2008-6878 affects Zen Cart versions 1.3.8 and 1.3.8a, as well as earlier versions.
Can CVE-2008-6878 lead to remote code execution?
Yes, CVE-2008-6878 can allow remote attackers to include and execute arbitrary local files, potentially leading to remote code execution.
Is CVE-2008-6878 easily exploitable?
Yes, CVE-2008-6878 can be easily exploited by manipulating the _SESSION[language] parameter if .htaccess is not supported.
SecAlerts Pty Ltd. 132 Wickham Terrace Fortitude Valley, QLD 4006, Australia info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.