Back to CVE Browser

CVE-2015-8352

CRITICAL

9.8

CVSS Severity Score

EPSS Score0.1040%

EPSS Percentile22.60th

PublishedAug 24, 2017

Last ModifiedMay 13, 2026

Vulnerability Description

Directory traversal vulnerability in Zen Cart 1.5.4 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the act parameter to ajax.php.

Affected Platforms (CPE)

📦

Zen Cart

Zen Cart

= 1.5.4

References & Advisories

🔗 http://www.securityfocus.com/archive/1/537129/100/0/threaded

🔗 https://www.exploit-db.com/exploits/39017/

🔗 https://www.htbridge.com/advisory/HTB23282

🔗 https://www.zen-cart.com/showthread.php?218914-Security-Patches-for-v1-5-4-November-2015

🔗 http://www.securityfocus.com/archive/1/537129/100/0/threaded

🔗 https://www.exploit-db.com/exploits/39017/

🔗 https://www.htbridge.com/advisory/HTB23282

🔗 https://www.zen-cart.com/showthread.php?218914-Security-Patches-for-v1-5-4-November-2015

Related Vulnerabilities

CVE-2006-069710.0

Zen Cart before 1.2.7 does not protect the admin/includes directory, which allows remote attackers to cause unknown impact via uns...

CVE-2006-069810.0

Unspecified vulnerabilities in Zen Cart before 1.2.7 allow remote attackers to cause unknown impact via unspecified vectors relate...

CVE-2020-65779.8

The IT-Recht Kanzlei plugin in Zen Cart 1.5.6c (German edition) allows itrk-api.php rechtstext_language SQL Injection.

CVE-2007-35978.5

Session fixation vulnerability in Zen Cart 1.3.7 and earlier allows remote attackers to hijack web sessions by setting the Cookie ...