| Título | Zen Cart 2.2.2 Code Injection |
|---|
| Descripción | Zen Cart 2.2.2 is vulnerable to Remote Code Execution (RCE) due to an unsafe dynamic function call mechanism in the administrative module management component. The vulnerability exists in the interaction between admin/modules.php and the helper function zen_call_function defined in admin/includes/functions/general.php. In admin/modules.php, the code retrieves configuration values that are used as function names in zen_call_function. An attacker can modify these configuration values (e.g., via SQL injection or other means) to execute arbitrary system commands. PoC: 1. Log in to the Zen Cart admin panel. 2. Use the SQL Patch tool (cmd=sqlpatch) to inject the payload: UPDATE configuration SET use_function = 'system' , configuration_value = 'id > /tmp/rce_call_user_func.txt' WHERE configuration_key = 'MODULE_SHIPPING_FLAT_STATUS'. 3. Navigate to the Shipping Modules page: index.php?cmd=modules&set=shipping. 4. The zen_call_function will be triggered, executing system('id > /tmp/rce_call_user_func.txt'). |
|---|
| Fuente | ⚠️ https://cdkkx.github.io/posts/GHSA-xrv3-wg8v-w8q8.html |
|---|
| Usuario | cdhhsk (UID 99312) |
|---|
| Sumisión | 2026-07-09 08:41 (hace 4 meses) |
|---|
| Moderación | 2026-10-11 13:10 (3 months later) |
|---|
| Estado | Aceptado |
|---|
| Entrada de VulDB | 416603 [Zen Cart hasta 2.2.2 Administrative Module Management general.php zen_call_function use_function escalada de privilegios] |
|---|
| Puntos | 20 |
|---|