CVE-2009-4321: extras/curltest.php in Zen Cart 1.3.8 and 1.3.8a, and possibly other versions, allows remote attackers to read arbitrary files via a file:// URI

Unscored severity · published Dec 14, 2009

CVE-2009-4321

extras/curltest.php in Zen Cart 1.3.8 and 1.3.8a, and possibly other versions, allows remote attackers to read arbitrary files via a file:// URI

–

CVSS

2.5%

EPSS

On KEV

Description

extras/curltest.php in Zen Cart 1.3.8 and 1.3.8a, and possibly other versions, allows remote attackers to read arbitrary files via a file:// URI. NOTE: some of these details are obtained from third party information.

Exploitation

Is it being used?

Exploit prediction (EPSS)2.5% · higher than 85% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

Zen Cart · Zen-cart

1.3.8; 1.3.8a · source: NVD

Affected product

Zen Cart

Zen-cart

All Zen Cart CVEs

References

NVD

https://nvd.nist.gov/vuln/detail/CVE-2009-4321

CVE.org

https://www.cve.org/CVERecord?id=CVE-2009-4321

osvdb.org

http://osvdb.org/60892

Vendor Advisory

http://secunia.com/advisories/37630

Exploit

http://www.acunetix.com/blog/websecuritynews/acusensor-curl-and-zen-cart/

www.securityfocus.com

http://www.securityfocus.com/archive/1/508340/100/0/threaded

www.securityfocus.com

http://www.securityfocus.com/bid/37283

Vendor Advisory

http://www.vupen.com/english/advisories/2009/3474