| Title | Zen Cart 2.2.2 Code Injection |
|---|
| Description | Zen Cart 2.2.2 is vulnerable to Remote Code Execution (RCE) due to an unsafe dynamic function call mechanism in the administrative module management component. The vulnerability exists in the interaction between admin/modules.php and the helper function zen_call_function defined in admin/includes/functions/general.php. In admin/modules.php, the code retrieves configuration values that are used as function names in zen_call_function. An attacker can modify these configuration values (e.g., via SQL injection or other means) to execute arbitrary system commands. PoC: 1. Log in to the Zen Cart admin panel. 2. Use the SQL Patch tool (cmd=sqlpatch) to inject the payload: UPDATE configuration SET use_function = 'system' , configuration_value = 'id > /tmp/rce_call_user_func.txt' WHERE configuration_key = 'MODULE_SHIPPING_FLAT_STATUS'. 3. Navigate to the Shipping Modules page: index.php?cmd=modules&set=shipping. 4. The zen_call_function will be triggered, executing system('id > /tmp/rce_call_user_func.txt'). |
|---|
| Source | ⚠️ https://cdkkx.github.io/posts/GHSA-xrv3-wg8v-w8q8.html |
|---|
| User | cdhhsk (UID 99312) |
|---|
| Submission | 07/09/2026 08:41 (3 months ago) |
|---|
| Moderation | 10/11/2026 13:10 (3 months later) |
|---|
| Status | Accepted |
|---|
| VulDB entry | 416603 [Zen Cart up to 2.2.2 Administrative Module Management general.php zen_call_function use_function code injection] |
|---|
| Points | 20 |
|---|