Zen Cart 1.3.8a, 1.3.8, and earlier does not require administrative authentication for admin/sqlpatch.php, which allows remote attackers to execute arbitrary SQL commands via the querystring parameter in an execute action, in conjunction with a PATHINFO of passwordforgotten.php, related to a "SQL Execution" issue.
Zen Cart 1.3.8a, 1.3.8, and earlier does not require administrative authentication for admin/recordcompany.php, which allows remote attackers to execute arbitrary code by uploading a .php file via the recordcompanyimage parameter in conjunction with a PATHINFO of passwordforgotten.php, then accessing this file via a direct request to the file in images/.
DISPUTED Directory traversal vulnerability in admin/includes/initsystem.php in Zen Cart 1.3.8 and 1.3.8a, when .htaccess is not supported, allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the loaderfile parameter. NOTE: the vendor disputes this issue, stating "at worst, the use of this vulnerability will reveal some local file paths."
DISPUTED Directory traversal vulnerability in admin/includes/languages/english.php in Zen Cart 1.3.8a, 1.3.8, and earlier, when .htaccess is not supported, allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the SESSION[language] parameter. NOTE: the vendor disputes this issue, stating "at worst, the use of this vulnerability will reveal some local file paths."
Multiple SQL injection vulnerabilities in includes/classes/shoppingcart.php in Zen Cart 1.2.0 through 1.3.8a, when magicquotesgpc is disabled, allow remote attackers to execute arbitrary SQL commands via the id parameter when (1) adding or (2) updating the shopping cart.
SQL injection vulnerability in the actionMultipleAddProduct function in includes/classes/shoppingcart.php in Zen Cart 1.3.0 through 1.3.8a, when magicquotesgpc is disabled, allows remote attackers to execute arbitrary SQL commands via the productsid array parameter in a multipleproductsaddproduct action, a different vulnerability than CVE-2008-6985.
extras/curltest.php in Zen Cart 1.3.8 and 1.3.8a, and possibly other versions, allows remote attackers to read arbitrary files via a file:// URI. NOTE: some of these details are obtained from third party information.
Cross-site scripting (XSS) vulnerability in includes/templates/templatedefault/templates/tplgvsenddefault.php in Zen Cart before 1.5 allows remote attackers to inject arbitrary web script or HTML via the message parameter in a gvsend action to index.php, a different vulnerability than CVE-2011-4547.