CVE-2009-20006

published 2025-09-16

CVE-2009-20006: osCommerce versions up to and including 2.2 RC2a contain a vulnerability in its administrative file manager utility (admin/file_manager.php). The interface…

Priority P2 72 critical 9.3 CVSS 4.0

AV N AC L AT N PR N UI N VC H VI H VA H SC N SI N SA N E X CR X IR X AR X MAV X MAC X MAT X MPR X MUI X MVC X MVI X MVA X MSC X MSI X MSA X S X AU X R X V X RE X U X

EXPLOIT

osCommerce versions up to and including 2.2 RC2a contain a vulnerability in its administrative file manager utility (admin/file_manager.php). The interface allows file uploads and edits without sufficient input validation or access control. An unauthenticated attacker can craft a POST request to upload a .php file containing arbitrary code, which is then executed by the server.

Affected

1 ranges

Vendor	Product	Version range	Fixed in
oscommerce	oscommerce	<= 2.2 RC2a	—

Detection & IOCs extracted from sources · hover to see the quote

path admin/file_manager.php↗

• → Monitor for unauthenticated POST requests targeting admin/file_manager.php, especially those uploading .php files ↗
• → Alert on .php file uploads via the osCommerce file manager utility from unauthenticated sessions ↗
• → Detect webshell execution originating from the osCommerce admin file manager, running with webserver permissions ↗

• · Vulnerability affects osCommerce versions up to and including 2.2 RC2a; verify target version before applying detections ↗
• · A public Metasploit exploit module exists for this vulnerability, lowering the bar for exploitation significantly ↗

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-434