| Título | Zen Cart 2.2.2 SQL Injection |
|---|
| Descrição | A SQL Injection vulnerability in the Zen Cart administrative backend allows an authenticated administrator to execute arbitrary SQL commands by manipulating the keys of the configuration POST array. The vulnerability is located in admin/modules.php. When saving module configurations, the application iterates through the $_POST['configuration'] array. The keys of this array are used directly in a SQL query without proper sanitization or parameterization, allowing for the injection of malicious SQL code. An attacker can gain full read/write access to the database, leading to data theft and store setting modification. |
|---|
| Fonte | ⚠️ https://cdkkx.github.io/posts/GHSA-g443-8869-6g52.html |
|---|
| Utilizador | cdhhsk (UID 99312) |
|---|
| Submissão | 09/07/2026 08h49 (há 4 meses) |
|---|
| Moderação | 11/10/2026 13h10 (3 months later) |
|---|
| Estado | Aceite |
|---|
| Entrada VulDB | 416605 [Zen Cart até 2.2.2 Module Configuration admin/modules.php configuration Injeção SQL] |
|---|
| Pontos | 20 |
|---|