| عنوان | Zen Cart 2.2.2 SQL Injection |
|---|
| الوصف | A SQL Injection vulnerability in the Zen Cart administrative backend allows an authenticated administrator to execute arbitrary SQL commands by manipulating the keys of the configuration POST array. The vulnerability is located in admin/modules.php. When saving module configurations, the application iterates through the $_POST['configuration'] array. The keys of this array are used directly in a SQL query without proper sanitization or parameterization, allowing for the injection of malicious SQL code. An attacker can gain full read/write access to the database, leading to data theft and store setting modification. |
|---|
| المصدر | ⚠️ https://cdkkx.github.io/posts/GHSA-g443-8869-6g52.html |
|---|
| المستخدم | cdhhsk (UID 99312) |
|---|
| ارسال | 09/07/2026 08:49 AM (3 أشهر منذ) |
|---|
| الاعتدال | 11/10/2026 01:10 PM (3 months later) |
|---|
| الحالة | تمت الموافقة |
|---|
| إدخال VulDB | 416605 [Zen Cart حتى 2.2.2 Module Configuration admin/modules.php configuration حقن SQL] |
|---|
| النقاط | 20 |
|---|