| Título | Zen Cart 2.2.2 SQL Injection |
|---|
| Descripción | A SQL Injection vulnerability in the Zen Cart administrative backend allows an authenticated administrator to execute arbitrary SQL commands by manipulating the keys of the configuration POST array. The vulnerability is located in admin/modules.php. When saving module configurations, the application iterates through the $_POST['configuration'] array. The keys of this array are used directly in a SQL query without proper sanitization or parameterization, allowing for the injection of malicious SQL code. An attacker can gain full read/write access to the database, leading to data theft and store setting modification. |
|---|
| Fuente | ⚠️ https://cdkkx.github.io/posts/GHSA-g443-8869-6g52.html |
|---|
| Usuario | cdhhsk (UID 99312) |
|---|
| Sumisión | 2026-07-09 08:49 (hace 4 meses) |
|---|
| Moderación | 2026-10-11 13:10 (3 months later) |
|---|
| Estado | Aceptado |
|---|
| Entrada de VulDB | 416605 [Zen Cart hasta 2.2.2 Module Configuration admin/modules.php configuration inyección SQL] |
|---|
| Puntos | 20 |
|---|