| Title | Zen Cart 2.2.2 SQL Injection |
|---|
| Description | An unauthenticated SQL injection vulnerability exists in Zen Cart 2.2.2's PayPal IPN handler (ipn_main_handler.php). The vulnerability arises because user-supplied input from the txn_id POST parameter is used unsafely in a WHERE clause within the zen_db_perform() function. While the SET clause values are sanitized, the $whereCondition is appended directly to the query string. Successful exploitation allows an unauthenticated attacker to read sensitive data from the database, including administrator password hashes, customer PII, and order history. PoC: A POST request to ipn_main_handler.php with a payload like txn_id=SEED_TXN_001' AND (SELECT 1 FROM (SELECT(SLEEP(5)))a)-- - |
|---|
| Source | ⚠️ https://cdkkx.github.io/posts/VE-0086.html |
|---|
| User | cdhhsk (UID 99312) |
|---|
| Submission | 07/09/2026 08:02 (3 months ago) |
|---|
| Moderation | 10/11/2026 13:09 (3 months later) |
|---|
| Status | Accepted |
|---|
| VulDB entry | 416602 [Zen Cart up to 2.2.2 PayPal IPN paypaldp.php zen_db_perform txn_id sql injection] |
|---|
| Points | 20 |
|---|