CVE Catalog
CVE-2015-8352
CriticalSummary
Directory traversal vulnerability in Zen Cart 1.5.4 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the act parameter to ajax.php.
Risk Assessment
Attackers may gain access to sensitive files on the server, potentially leading to data exposure or remote code execution.
Recommendation
It is recommended to update Zen Cart to the latest version and implement input parameter filtering and validation in the application.
Original NVD description (English source)
Directory traversal vulnerability in Zen Cart 1.5.4 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the act parameter to ajax.php.