CVE-2024-5762

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2024-5762

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-5762.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2024-5762

Published

2024-08-21T16:15:27.278Z

Modified

2026-07-15T01:49:07.780104526Z

Severity

8.1 (High) CVSS_V3 - CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator

Summary

Zen Cart findPluginAdminPage Local File Inclusion Remote Code Execution Vulnerability

Details

Zen Cart findPluginAdminPage Local File Inclusion Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Zen Cart. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the findPluginAdminPage function. The issue results from the lack of proper validation of user-supplied data prior to passing it to a PHP include function. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the service account. Was ZDI-CAN-21408.

Database specific

{
    "cna_assigner": "zdi",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/5xxx/CVE-2024-5762.json",
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "introduced": "1.5.8a"
                },
                {
                    "last_affected": "1.5.8a"
                }
            ],
            "source": "AFFECTED_FIELD"
        }
    ],
    "cwe_ids": [
        "CWE-98"
    ]
}

References

Affected packages

Git / github.com/zencart/zencart

Affected ranges

Type

GIT

Repo

https://github.com/zencart/zencart

Events

Introduced

3db8d527910b7fc0f0fb9e2f722833cb9d973d79

Last affected

3db8d527910b7fc0f0fb9e2f722833cb9d973d79

Database specific

{
    "cpe": "cpe:2.3:a:zen-cart:zen_cart:1.5.8a:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "1.5.8a"
        },
        {
            "last_affected": "1.5.8a"
        }
    ],
    "source": "CPE_STRING"
}

Affected versions

1.*

1.5.8a

v1.*

v1.5.8a

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-5762.json"