| عنوان | Zen Cart 2.2.2 SQL Injection |
|---|
| الوصف | An unauthenticated SQL injection vulnerability exists in Zen Cart 2.2.2's PayPal IPN handler (ipn_main_handler.php). The vulnerability arises because user-supplied input from the txn_id POST parameter is used unsafely in a WHERE clause within the zen_db_perform() function. While the SET clause values are sanitized, the $whereCondition is appended directly to the query string. Successful exploitation allows an unauthenticated attacker to read sensitive data from the database, including administrator password hashes, customer PII, and order history. PoC: A POST request to ipn_main_handler.php with a payload like txn_id=SEED_TXN_001' AND (SELECT 1 FROM (SELECT(SLEEP(5)))a)-- - |
|---|
| المصدر | ⚠️ https://cdkkx.github.io/posts/VE-0086.html |
|---|
| المستخدم | cdhhsk (UID 99312) |
|---|
| ارسال | 09/07/2026 08:02 AM (4 أشهر منذ) |
|---|
| الاعتدال | 11/10/2026 01:09 PM (3 months later) |
|---|
| الحالة | تمت الموافقة |
|---|
| إدخال VulDB | 416602 [Zen Cart حتى 2.2.2 PayPal IPN paypaldp.php zen_db_perform txn_id حقن SQL] |
|---|
| النقاط | 20 |
|---|