CVE-2008-6878: Path Traversal

Published Jul 27, 2009

Updated

DISPUTED Directory traversal vulnerability in admin/includes/languages/english.php in Zen Cart 1.3.8a, 1.3.8, and earlier, when .htaccess is not supported, allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the SESSION[language] parameter. NOTE: the vendor disputes this issue, stating "at worst, the use of this vulnerability will reveal some local file paths."

Affected Software

2 affected components

Zen Cart Zen Cart=1.3.8

Zen Cart Zen Cart=1.3.8a

Event History

Jul 27, 2009

CVE Published

via MITRE·02:22 PM

Data Sourced

via MITRE·02:22 PM

Description

Disputed

02:30 PM

Frequently Asked Questions

What is the severity of CVE-2008-6878?

CVE-2008-6878 is considered a medium severity vulnerability due to its impact on file inclusion and arbitrary code execution.

How do I fix CVE-2008-6878?

To fix CVE-2008-6878, upgrade Zen Cart to the latest version that addresses this vulnerability or implement restrictions to prevent directory traversal.

What versions of Zen Cart are affected by CVE-2008-6878?

CVE-2008-6878 affects Zen Cart versions 1.3.8 and 1.3.8a, as well as earlier versions.

Can CVE-2008-6878 lead to remote code execution?

Yes, CVE-2008-6878 can allow remote attackers to include and execute arbitrary local files, potentially leading to remote code execution.

Is CVE-2008-6878 easily exploitable?

Yes, CVE-2008-6878 can be easily exploited by manipulating the _SESSION[language] parameter if .htaccess is not supported.