CVE-2017-11675 — The traverseStrictSanitize function in admin_dir/includes/classes/AdminRequestSanitizer.php in ZenCart 1.5.5e mishandles key strings, which allows remote authenticated users to execute arbitrary PHP code by placing that code into an invalid array index of the admin_name array parameter to admin_dir/login.php, if there is an export of an error-log entry for that invalid array index

Back Back to CVE browser

HIGH

The traverseStrictSanitize function in admin_dir/includes/classes/AdminRequestSanitizer.php in ZenCart 1.5.5e mishandles key strings, which allows remote authenticated users to execute arbitrary PHP code by placing that code into an invalid array index of the admin_name array parameter to admin_dir/login.php, if there is an export of an error-log entry for that invalid array index

Published Jul 27, 2017

8.8

HIGH

CVSS 3.0

EPSS 2.90%

Description

The traverseStrictSanitize function in admin_dir/includes/classes/AdminRequestSanitizer.php in ZenCart 1.5.5e mishandles key strings, which allows remote authenticated users to execute arbitrary PHP code by placing that code into an invalid array index of the admin_name array parameter to admin_dir/login.php, if there is an export of an error-log entry for that invalid array index.

Affected products

Remediation

No remediation recorded yet.

Metrics

2.90% 0.02896

Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 2, 2026.

EPSS probability 0.02896

Score over time

2021–2026

EPSS v1
EPSS v2
EPSS v3
EPSS v4
EPSS v5

Percentile over time

EPSS v1
EPSS v2
EPSS v3
EPSS v4
EPSS v5

Table of values (15 key points)

Flat stretches are collapsed; showing up to 120 newest points.

Date	Score	Percentile	Model
Oct 2, 2026	2.90% (0.02896)	86.46th	v5 (v2026.06.15)
Jun 15, 2026	2.90% (0.02896)	85.06th	v5 (v2026.06.15)
Mar 29, 2025	1.71% (0.01715)	71.00th	v4 (v2025.03.14)
Jul 20, 2024	0.26% (0.00259)	65.98th	v3 (v2023.03.01)
Apr 5, 2024	0.26% (0.00259)	65.08th	v3 (v2023.03.01)
Sep 22, 2023	0.26% (0.00259)	63.08th	v3 (v2023.03.01)
Mar 7, 2023	0.28% (0.00276)	63.10th	v3 (v2023.03.01)
Mar 6, 2023	1.05% (0.01055)	52.13th	v2 (v2022.01.01)
Sep 17, 2022	1.05% (0.01055)	50.47th	v2 (v2022.01.01)
Apr 1, 2022	1.05% (0.01055)	48.43th	v2 (v2022.01.01)
Feb 4, 2022	1.05% (0.01055)	27.52th	v2 (v2022.01.01)
Feb 3, 2022	0.52% (0.00523)	12.55th	v1
Jan 6, 2022	0.52% (0.00523)	12.10th	v1
Sep 1, 2021	0.52% (0.00523)	32.27th	v1
Apr 14, 2021	0.52% (0.00523)	0.00th	v1

Weaknesses (1)

CWE-94

Code Injection

References (3)

https://github.com/advisories/GHSA-c9r9-3h38-r7vj
Advisory
https://github.com/imp0wd3r/vuln-papers/tree/master/zencart-155e-auth-rce
x_refsource_MISCThird Party Advisory
https://nvd.nist.gov/vuln/detail/CVE-2017-11675

Link	Providers	Tags
https://github.com/advisories/GHSA-c9r9-3h38-r7vj		Advisory
https://github.com/imp0wd3r/vuln-papers/tree/master/zencart-155e-auth-rce		x_refsource_MISCThird Party Advisory
https://nvd.nist.gov/vuln/detail/CVE-2017-11675