| Title | Zen Cart 2.2.2 SQL Injection |
|---|
| Description | A SQL Injection vulnerability in the Zen Cart administrative backend allows an authenticated administrator to execute arbitrary SQL commands by manipulating the keys of the configuration POST array. The vulnerability is located in admin/modules.php. When saving module configurations, the application iterates through the $_POST['configuration'] array. The keys of this array are used directly in a SQL query without proper sanitization or parameterization, allowing for the injection of malicious SQL code. An attacker can gain full read/write access to the database, leading to data theft and store setting modification. |
|---|
| Source | ⚠️ https://cdkkx.github.io/posts/GHSA-g443-8869-6g52.html |
|---|
| User | cdhhsk (UID 99312) |
|---|
| Submission | 07/09/2026 08:49 (3 months ago) |
|---|
| Moderation | 10/11/2026 13:10 (3 months later) |
|---|
| Status | Accepted |
|---|
| VulDB entry | 416605 [Zen Cart up to 2.2.2 Module Configuration admin/modules.php configuration sql injection] |
|---|
| Points | 20 |
|---|