CVE-2009-20006

CriticalCVSS 9.3

Published: 16/09/2025(UTC)Updated: 01/10/2026(UTC)Translated: 02/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Elevated risk

1.23%

68th percentile - higher than 68% of all known CVEs

Summary

osCommerce versions up to and including 2.2 RC2a contain a vulnerability in its administrative file manager utility (admin/file_manager.php). The interface allows file uploads and edits without sufficient input validation or access control, enabling an unauthenticated attacker to upload a .php file containing arbitrary code, which is then executed by the server.

Risk Assessment

An attacker can remotely execute arbitrary code on the server, leading to full compromise of the application and potentially the entire server. This could result in theft of customer data and further attacks.

Recommendation

Update osCommerce to a newer version or remove/restrict access to admin/file_manager.php. Implementing authentication and file upload validation is also recommended.

Other vulnerabilities in osCommerce

CVE-2026-18592Medium
A security flaw has been discovered in osCommerce 4.14.63493. Affected is the function EmailController of the file app/lib/backend/controllers/EmailController.php of the component Email Template Configuration. Manipulation of the argument email_templates_key results in SQL injection. The attack is possible remotely and the exploit has been released.

Original NVD description (English source)

osCommerce versions up to and including 2.2 RC2a contain a vulnerability in its administrative file manager utility (admin/file_manager.php). The interface allows file uploads and edits without sufficient input validation or access control. An unauthenticated attacker can craft a POST request to upload a .php file containing arbitrary code, which is then executed by the server.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS