Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Vulnerability Description
Zen Cart 1.3.8a, 1.3.8, and earlier does not require administrative authentication for admin/sqlpatch.php, which allows remote attackers to execute arbitrary SQL commands via the query_string parameter in an execute action, in conjunction with a PATH_INFO of password_forgotten.php, related to a "SQL Execution" issue.
CVSS Information
N/A
Vulnerability Type
N/A
Vulnerability Title
Zen Cart admin/sqlpatch.php模块SQL注入漏洞
Vulnerability Description
Zen Cart是Zen Cart团队开发的一套开源的购物车系统。该系统主要用于建立网上商店，可支持多种付款方式、多语言选择、网上商城批量更新等。 Zen Cart 1.38a,1.38和更早版本没有对admin/sqlpatch.php模块强制管理认证，这允许远程攻击者在请求中通过query_string和PATH_INFO参数执行SQL注入攻击。
CVSS Information
N/A
Vulnerability Type
N/A