CVE-2009-2254: Zen Cart 1.3.8a, 1.3.8, and earlier does not require administrative authentication for admin/sqlpatch.php,...

Security readout for executives and security teams

This issue affects legacy Zen Cart stores and can let an unauthenticated remote attacker run SQL against the store database through an administrative patch script. For an ecommerce site, that can threaten customer data, order records, administrator accounts, and site integrity. The supplied sources do not confirm active exploitation. Exposure is most likely on internet-facing Zen Cart installations at 1.3.8a, 1.3.8, or earlier, especially where the admin directory and sqlpatch.php remain web-accessible. Prioritize any live legacy Zen Cart store because the described impact is direct database manipulation without administrative authentication. If no affected Zen Cart is present, residual risk is low. Mitigation focus: Inventory Zen Cart installations and confirm exact versions.; Check Zen Cart vendor guidance for the appropriate fixed upgrade path.; Restrict public web access to administrative scripts, especially admin/sqlpatch.php..

Prepared

Jun 28, 2026, 10:45 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.