CVE-2024-5762: zen_cart PHP Remote File Inclusion
Vulnerability summary
CVE-2024-5762 is a high (CVSS 8.1) PHP Remote File Inclusion vulnerability in zen_cart. EPSS estimates a 71.60% chance of exploitation in the next 30 days, higher than 99.4% of scored vulnerabilities.
Timeline
- 21-08-2024PublishedVulnerability first disclosed.
- 21-08-2024Last modifiedVulnerability information updated.
Description
Zen Cart findPluginAdminPage Local File Inclusion Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Zen Cart. Authentication is not required to exploit this vulnerability. The specific flaw exists within the findPluginAdminPage function. The issue results from the lack of proper validation of user-supplied data prior to passing it to a PHP include function. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the service account. Was ZDI-CAN-21408.
CVSS metrics
3 scores · 2 sources · 2 versions- NVDNIST8.1HighCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
71.60%
Chance of exploitation in the next 30 days
Percentile
99%
Versus all other CVEs
30-day change
0.00 pp
From 71.60% on 21-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-98Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')The PHP application receives input from an upstream component, but it does not restrict or incorrectly restricts the input before its usage in "require," "include," or similar functions.
- CWE-829Inclusion of Functionality from Untrusted Control SphereThe product imports, requires, or includes executable functionality (such as a library) from a source that is outside of the intended control sphere.
Affected systems
2 vendors · 2 products