| 제목 | Zen Cart 2.2.2 SQL Injection |
|---|
| 설명 | An unauthenticated SQL injection vulnerability exists in Zen Cart 2.2.2's PayPal IPN handler (ipn_main_handler.php). The vulnerability arises because user-supplied input from the txn_id POST parameter is used unsafely in a WHERE clause within the zen_db_perform() function. While the SET clause values are sanitized, the $whereCondition is appended directly to the query string. Successful exploitation allows an unauthenticated attacker to read sensitive data from the database, including administrator password hashes, customer PII, and order history. PoC: A POST request to ipn_main_handler.php with a payload like txn_id=SEED_TXN_001' AND (SELECT 1 FROM (SELECT(SLEEP(5)))a)-- - |
|---|
| 원천 | ⚠️ https://cdkkx.github.io/posts/VE-0086.html |
|---|
| 사용자 | cdhhsk (UID 99312) |
|---|
| 제출 | 2026. 07. 09. AM 08:02 (4 개월 ago) |
|---|
| 모더레이션 | 2026. 10. 11. PM 01:09 (3 months later) |
|---|
| 상태 | 수락 |
|---|
| VulDB 항목 | 416602 [Zen Cart 까지 2.2.2 PayPal IPN paypaldp.php zen_db_perform txn_id SQL 주입] |
|---|
| 포인트들 | 20 |
|---|