Secunia

A vulnerability has been discovered in Zen Cart, which can be exploited by malicious people to bypass certain security restrictions.

The vulnerability is caused due to the application not properly restricting access to the administration panel. This can be exploited to access certain administrative functions, which can used to e.g. conduct SQL injection attacks and upload and execute arbitrary PHP code.

Note: Successful exploitation requires that the "admin" folder was not correctly renamed during the installation process.

The vulnerability is confirmed in version 1.3.8a (full fileset 12112007). Other versions may also be affected.

Solution
Apply patch.
Further details available in Customer Area

Provided and/or discovered by
BlackH

Changelog
Further details available in Customer Area

Original Advisory
Zen Cart:
http://www.zen-cart.com/forum/showthread.php?t=130161

BlackH:
http://milw0rm.com/exploits/9004
http://milw0rm.com/exploits/9005

Deep Links
Links available in Customer Area