CVE-2009-1936

CVE-2009-1936 affects cpCommerce 1.2.x, including version 1.2.9, and stems from a flaw in the _functions.php file where a redirect is sent but the script does not exit when called directly. This bypasses a protection mechanism, enabling remote attackers to conduct remote file inclusion and directory traversal attacks. The vulnerability has a critical CVSS score of 9.8, indicating a network-exploitable flaw with low attack complexity, allowing for complete compromise of confidentiality, integrity, and availability. While not listed on CISA's KEV catalog, an exploit is publicly available on ExploitDB, and the vulnerability has garnered significant community discussion, suggesting awareness among threat actors.