[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fUTpgsEhswjWlZnZToC1-j3gnKuG0zRN271gpOfiKe5c":3,"g5a-risk:CVE-2009-2254":178},{"success":4,"data":5,"meta":176},true,{"cveId":6,"title":7,"description":8,"shortDescription":9,"publishedDate":10,"lastModified":11,"cvssScore":12,"cvssVector":13,"cvssMetrics":14,"epssScore":34,"epssPercentile":28,"epssTimeSeries":35,"severity":36,"affectedProducts":37,"affectedProductsCount":67,"references":68,"referencesCount":113,"weaknesses":114,"weaknessesCount":122,"isActivelyExploited":32,"cisaInfo":28,"otxData":28,"relatedBlogPosts":123,"seoMetadata":124,"configurations":149,"relatedVendorCves":174,"notableEvents":175},"CVE-2009-2254","What is CVE-2009-2254?","Zen Cart 1.3.8a, 1.3.8, and earlier does not require administrative authentication for admin\u002Fsqlpatch.php, which allows remote attackers to execute arbitrary SQL commands via the query_string parameter in an execute action, in conjunction with a PATH_INFO of password_forgotten.php, related to a \"SQL Execution\" issue.","Zen Cart 1.3.8a, 1.3.8, and earlier does not require administrative authentication for admin\u002Fsqlpatch.php, which allows remote attackers to execute arbitrary...","2009-06-30T10:30:11.687","2026-06-16T23:09:04.867",7.5,"AV:N\u002FAC:L\u002FAu:N\u002FC:P\u002FI:P\u002FA:P",{"CVSSMetricV31":15,"CVSSMetricV30":16,"CVSSMetricV2":17,"CVSSMetricV40":33},[],[],[18],{"Source":19,"Type":20,"CVSSData":21,"BaseSeverity":29,"ExploitabilityScore":30,"ImpactScore":31,"ACInsufInfo":32,"ObtainAllPrivilege":32,"ObtainUserPrivilege":32,"ObtainOtherPrivilege":32,"UserInteractionRequired":32},"nvd@nist.gov","Primary",{"Version":22,"VectorString":13,"AccessVector":23,"AccessComplexity":24,"Authentication":25,"ConfidentialityImpact":26,"IntegrityImpact":26,"AvailabilityImpact":26,"BaseScore":12,"BaseSeverity":27,"Exploitability":28,"RemediationLevel":28,"ReportConfidence":28,"TemporalScore":28,"CollateralDamagePotential":28,"TargetDistribution":28,"ConfidentialityRequirement":28,"IntegrityRequirement":28,"AvailabilityRequirement":28,"EnvironmentalScore":28},"2.0","NETWORK","LOW","NONE","PARTIAL","",null,"HIGH",10,6.4,false,[],0.1089,[34,34,34,34,34,34,34],"High",[38,43,46,49,52,55,58,61,64],{"vendor":39,"product":40,"version":41,"criteria":42,"vulnerable":4},"zen-cart","zen_cart","*","cpe:2.3:a:zen-cart:zen_cart:*:*:*:*:*:*:*:*",{"vendor":39,"product":40,"version":44,"criteria":45,"vulnerable":4},"1.1.0","cpe:2.3:a:zen-cart:zen_cart:1.1.0:*:*:*:*:*:*:*",{"vendor":39,"product":40,"version":47,"criteria":48,"vulnerable":4},"1.1.3","cpe:2.3:a:zen-cart:zen_cart:1.1.3:*:*:*:*:*:*:*",{"vendor":39,"product":40,"version":50,"criteria":51,"vulnerable":4},"1.2.0d","cpe:2.3:a:zen-cart:zen_cart:1.2.0d:*:*:*:*:*:*:*",{"vendor":39,"product":40,"version":53,"criteria":54,"vulnerable":4},"1.2.1d","cpe:2.3:a:zen-cart:zen_cart:1.2.1d:*:*:*:*:*:*:*",{"vendor":39,"product":40,"version":56,"criteria":57,"vulnerable":4},"1.2.4d","cpe:2.3:a:zen-cart:zen_cart:1.2.4d:*:*:*:*:*:*:*",{"vendor":39,"product":40,"version":59,"criteria":60,"vulnerable":4},"1.3.6","cpe:2.3:a:zen-cart:zen_cart:1.3.6:*:*:*:*:*:*:*",{"vendor":39,"product":40,"version":62,"criteria":63,"vulnerable":4},"1.3.7","cpe:2.3:a:zen-cart:zen_cart:1.3.7:*:*:*:*:*:*:*",{"vendor":39,"product":40,"version":65,"criteria":66,"vulnerable":4},"1.3.8","cpe:2.3:a:zen-cart:zen_cart:1.3.8:*:*:*:*:*:*:*",9,[69,74,78,82,88,92,95,99,101,103,105,107,109,111],{"url":70,"source":71,"tags":72},"http:\u002F\u002Fsecunia.com\u002Fadvisories\u002F35550","Secunia",[73],"Vendor Advisory",{"url":75,"source":76,"tags":77},"http:\u002F\u002Fwww.exploit-db.com\u002Fexploits\u002F9005","Exploit-db",[],{"url":79,"source":80,"tags":81},"http:\u002F\u002Fwww.osvdb.org\u002F55343","Osvdb",[],{"url":83,"source":84,"tags":85},"http:\u002F\u002Fwww.securityfocus.com\u002Fbid\u002F35468","Securityfocus",[86,87],"Exploit","Patch",{"url":89,"source":90,"tags":91},"http:\u002F\u002Fwww.zen-cart.com\u002Fforum\u002Fattachment.php?attachmentid=5965","Zen-cart",[87,73],{"url":93,"source":90,"tags":94},"http:\u002F\u002Fwww.zen-cart.com\u002Fforum\u002Fshowthread.php?t=130161",[87],{"url":96,"source":97,"tags":98},"https:\u002F\u002Fexchange.xforce.ibmcloud.com\u002Fvulnerabilities\u002F51317","Ibmcloud",[],{"url":70,"source":71,"tags":100},[73],{"url":75,"source":76,"tags":102},[],{"url":79,"source":80,"tags":104},[],{"url":83,"source":84,"tags":106},[86,87],{"url":89,"source":90,"tags":108},[87,73],{"url":93,"source":90,"tags":110},[87],{"url":96,"source":97,"tags":112},[],14,[115],{"id":116,"name":117,"description":118,"extendedDescription":27,"status":119,"abstraction":120,"structure":121},"CWE-89","Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.","Stable","Base","Simple",1,[],{"title":125,"metaDescription":126,"keywords":127,"canonicalUrl":128,"structuredData":129},"What is CVE-2009-2254? Vulnerability Analysis | Security Advisory | Precursor Intelligence","Comprehensive analysis of CVE-2009-2254, a high severity cyber security vulnerability from 2009. Zen Cart 1.3.8a, 1.3.8, and earlier does not require adminis...","CVE-2009-2254, CVE-2009-2254 vulnerability, CVE-2009-2254 security, high severity vulnerability, cybersecurity, vulnerability analysis, security advisory, CVE database, threat intelligence, security research, vulnerability assessment, cyber threats, 2009, CVSS score, exploit, patch, remediation, zen-cart security, zen_cart vulnerability","\u002Fwhat-is\u002Fcve-2009-2254",{"@context":130,"@type":131,"headline":125,"description":126,"datePublished":10,"dateModified":11,"author":132,"publisher":136,"about":140,"mainEntityOfPage":144,"articleSection":147,"keywords":148},"https:\u002F\u002Fschema.org","TechArticle",{"@type":133,"name":134,"url":135},"Organization","Precursor Intelligence","https:\u002F\u002Fprecursorintelligence.com",{"@type":133,"name":134,"url":135,"logo":137},{"@type":138,"url":139},"ImageObject","https:\u002F\u002Fprecursorintelligence.com\u002Fimg\u002Flogos\u002Feplogo.png",{"@type":141,"name":6,"description":142,"additionalType":143},"Thing","Cybersecurity Vulnerability","https:\u002F\u002Fschema.org\u002FSoftwareBug",{"@type":145,"@id":146},"WebPage","https:\u002F\u002Fprecursorintelligence.com\u002Fwhat-is\u002Fcve-2009-2254","Cybersecurity","CVE-2009-2254, CVE-2009-2254 vulnerability, CVE-2009-2254 security, high severity vulnerability, cybersecurity, vulnerability analysis, security advisory, CVE database, threat intelligence, security research",[150],{"Operator":28,"Negate":28,"Nodes":151},[152],{"Operator":153,"Negate":32,"CPEMatch":154},"OR",[155,158,160,162,164,166,168,170,172],{"Vulnerable":4,"Criteria":42,"MatchCriteriaID":156,"VersionStartExcluding":28,"VersionStartIncluding":28,"VersionEndExcluding":28,"VersionEndIncluding":157},"37FB73EA-495B-4C6C-99D2-E10F26AB7A78","1.3.8a",{"Vulnerable":4,"Criteria":45,"MatchCriteriaID":159,"VersionStartExcluding":28,"VersionStartIncluding":28,"VersionEndExcluding":28,"VersionEndIncluding":28},"8C929C74-3510-4A89-96CF-2109271008E6",{"Vulnerable":4,"Criteria":48,"MatchCriteriaID":161,"VersionStartExcluding":28,"VersionStartIncluding":28,"VersionEndExcluding":28,"VersionEndIncluding":28},"B3D1E7B9-BE05-4F16-8A3C-F0E8B23FF585",{"Vulnerable":4,"Criteria":51,"MatchCriteriaID":163,"VersionStartExcluding":28,"VersionStartIncluding":28,"VersionEndExcluding":28,"VersionEndIncluding":28},"C27DEB51-7745-4B5A-9E23-5491526E857E",{"Vulnerable":4,"Criteria":54,"MatchCriteriaID":165,"VersionStartExcluding":28,"VersionStartIncluding":28,"VersionEndExcluding":28,"VersionEndIncluding":28},"96BA0248-CF20-4DF4-AF6B-4E9CACE8109B",{"Vulnerable":4,"Criteria":57,"MatchCriteriaID":167,"VersionStartExcluding":28,"VersionStartIncluding":28,"VersionEndExcluding":28,"VersionEndIncluding":28},"82CED1DF-15F5-47A2-9C70-F276B466167E",{"Vulnerable":4,"Criteria":60,"MatchCriteriaID":169,"VersionStartExcluding":28,"VersionStartIncluding":28,"VersionEndExcluding":28,"VersionEndIncluding":28},"BDB743EA-A17B-406C-81CE-64A52FBB5966",{"Vulnerable":4,"Criteria":63,"MatchCriteriaID":171,"VersionStartExcluding":28,"VersionStartIncluding":28,"VersionEndExcluding":28,"VersionEndIncluding":28},"1BE00024-0295-43BE-8123-56526197B58E",{"Vulnerable":4,"Criteria":66,"MatchCriteriaID":173,"VersionStartExcluding":28,"VersionStartIncluding":28,"VersionEndExcluding":28,"VersionEndIncluding":28},"AE050A6F-DF2A-47E8-8188-59BC00C11E70",[],[],{"lastModified":11,"cacheTime":177,"version":22},1792370471156,{"score":179,"band":180,"action":181,"scoredAt":182},47,"Medium","Plan remediation","2026-10-17T06:36:45.33402+00:00"]