| Título | Zen Cart 2.2.2 Remote Code Execution |
|---|
| Descrição | The Zen Cart admin panel is vulnerable to Remote Code Execution (RCE) because it retrieves configuration settings from the database and passes them directly to the PHP eval() function without sufficient validation. In admin/configuration.php, the field set_function is retrieved and executed. An attacker can use a separate SQL injection to overwrite a configuration entry and then trigger the RCE by navigating to admin/configuration.php?gID=1. This allows execution of arbitrary system commands with the privileges of the web server user. |
|---|
| Fonte | ⚠️ https://cdkkx.github.io/posts/GHSA-233f-2p5c-vfgw.html |
|---|
| Utilizador | cdhhsk (UID 99312) |
|---|
| Submissão | 09/07/2026 08h44 (há 4 meses) |
|---|
| Moderação | 11/10/2026 13h10 (3 months later) |
|---|
| Estado | Aceite |
|---|
| Entrada VulDB | 416604 [Zen Cart 2.2.2 Admin Panel admin/configuration.php eval gID Injeção SQL] |
|---|
| Pontos | 20 |
|---|