| عنوان | Zen Cart 2.2.2 Remote Code Execution |
|---|
| الوصف | The Zen Cart admin panel is vulnerable to Remote Code Execution (RCE) because it retrieves configuration settings from the database and passes them directly to the PHP eval() function without sufficient validation. In admin/configuration.php, the field set_function is retrieved and executed. An attacker can use a separate SQL injection to overwrite a configuration entry and then trigger the RCE by navigating to admin/configuration.php?gID=1. This allows execution of arbitrary system commands with the privileges of the web server user. |
|---|
| المصدر | ⚠️ https://cdkkx.github.io/posts/GHSA-233f-2p5c-vfgw.html |
|---|
| المستخدم | cdhhsk (UID 99312) |
|---|
| ارسال | 09/07/2026 08:44 AM (3 أشهر منذ) |
|---|
| الاعتدال | 11/10/2026 01:10 PM (3 months later) |
|---|
| الحالة | تمت الموافقة |
|---|
| إدخال VulDB | 416604 [Zen Cart 2.2.2 Admin Panel admin/configuration.php eval gID حقن SQL] |
|---|
| النقاط | 20 |
|---|