CVE-2009-2255: Zen-Cart Zen Cart

Medium severity, CVSS 6.8. EPSS: 31% chance of exploitation in the next 30 days.

Zen Cart 1.3.8a, 1.3.8, and earlier does not require administrative authentication for admin/record_company.php, which allows remote attackers to execute arbitrary code by uploading a .php file via the record_company_image parameter in conjunction with a PATH_INFO of password_forgotten.php, then accessing this file via a direct request to the file in images/.

Affected products

• Zen-Cart Zen Cart: up to and including 1.3.8a; version 1.1.0 only; version 1.1.3 only; version 1.2.0d only; version 1.2.1d only; version 1.2.4d only; …

Published 2009-06-30. Last modified 2026-06-16.