CVE-2009-20006: osCommerce <= 2.2 Admin File Manager Arbitrary PHP Code Execution
osCommerce versions up to and including 2.2 RC2a contain a vulnerability in its administrative file manager utility (admin/filemanager.php). The interface allows file uploads and edits without sufficient input validation or access control. An unauthenticated attacker can craft a POST request to upload a .php file containing arbitrary code, which is then executed by the server.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2009-20006?
CVE-2009-20006 is classified as a high-severity vulnerability due to its potential for remote exploitation without authentication.
How do I fix CVE-2009-20006?
To fix CVE-2009-20006, upgrade to osCommerce version 2.2 RC2b or later, which addresses the file upload validation issues.
What impacts does CVE-2009-20006 have on my osCommerce installation?
CVE-2009-20006 allows attackers to upload arbitrary files, potentially compromising the integrity of your web application.
Who is affected by CVE-2009-20006?
Any user running osCommerce versions up to and including 2.2 RC2a is at risk of the vulnerabilities introduced in CVE-2009-20006.
Can CVE-2009-20006 be exploited remotely?
Yes, CVE-2009-20006 can be exploited remotely by unauthenticated attackers using the vulnerable administrative file manager.