CVE-2009-20006CWE-434unrestricted-file-upload

CVE-2009-20006

published September 16, 2025

CVSS
9.3
EPSS
2%
Percentile
75.5
In the wild
Unconfirmed
What it is

osCommerce versions up to and including 2.2 RC2a contain a vulnerability in its administrative file manager utility (admin/file_manager.php). The interface allows file uploads and edits without sufficient input validation or access control. An unauthenticated attacker can craft a POST request to upload a .php file containing arbitrary code, which is then executed by the server.

The record
Technical detail
CVSS
9.3 · NONE
CVSS v4.0
Not supplied
EPSS
0.01604 · 75.5th percentile
Weakness
CWE-434 · Unrestricted Upload of File with Dangerous Type
Published
2025-09-16T19:15Z
References (8)
https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/unix/webapp/oscommerce_filemanager.rb · [email protected]https://www.exploit-db.com/exploits/16899 · [email protected]https://www.exploit-db.com/exploits/9556 · [email protected]https://www.oscommerce.com/ · [email protected]https://www.vulncheck.com/advisories/oscommerce-arbitrary-php-code-execution · [email protected]https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/unix/webapp/oscommerce_filemanager.rb · 134c704f-9b21-4f2e-91b3-4a467353bcc0https://www.exploit-db.com/exploits/16899 · 134c704f-9b21-4f2e-91b3-4a467353bcc0https://www.exploit-db.com/exploits/9556 · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 16 SEP 14:33Z
    osCommerce <= 2.2 Admin File Manager Arbitrary PHP Code Execution
    cvelistv5