CVE-2009-2254: Zen-Cart Zen Cart

High severity, CVSS 7.5. EPSS: 10.9% chance of exploitation in the next 30 days.

Zen Cart 1.3.8a, 1.3.8, and earlier does not require administrative authentication for admin/sqlpatch.php, which allows remote attackers to execute arbitrary SQL commands via the query_string parameter in an execute action, in conjunction with a PATH_INFO of password_forgotten.php, related to a "SQL Execution" issue.

Affected products

• Zen-Cart Zen Cart: up to and including 1.3.8a; version 1.1.0 only; version 1.1.3 only; version 1.2.0d only; version 1.2.1d only; version 1.2.4d only; …

Published 2009-06-30. Last modified 2026-06-16.