| 제목 | Zen Cart 2.2.2 SQL Injection |
|---|
| 설명 | A SQL Injection vulnerability in the Zen Cart administrative backend allows an authenticated administrator to execute arbitrary SQL commands by manipulating the keys of the configuration POST array. The vulnerability is located in admin/modules.php. When saving module configurations, the application iterates through the $_POST['configuration'] array. The keys of this array are used directly in a SQL query without proper sanitization or parameterization, allowing for the injection of malicious SQL code. An attacker can gain full read/write access to the database, leading to data theft and store setting modification. |
|---|
| 원천 | ⚠️ https://cdkkx.github.io/posts/GHSA-g443-8869-6g52.html |
|---|
| 사용자 | cdhhsk (UID 99312) |
|---|
| 제출 | 2026. 07. 09. AM 08:49 (4 개월 ago) |
|---|
| 모더레이션 | 2026. 10. 11. PM 01:10 (3 months later) |
|---|
| 상태 | 수락 |
|---|
| VulDB 항목 | 416605 [Zen Cart 까지 2.2.2 Module Configuration admin/modules.php configuration SQL 주입] |
|---|
| 포인트들 | 20 |
|---|