CVE-2026-108828
MediumCVSS 4.1Summary
A SQL injection vulnerability was identified in Zen Cart 2.2.2, affecting the eval function of admin/configuration.php in the Admin Panel component, via manipulation of the gID argument. The attack can be initiated remotely, has high complexity, and is difficult to exploit. The exploit is publicly available. The vendor explains that set_function/use_function are not editable through any normal admin UI.
Risk Assessment
The vulnerability may allow an attacker to execute unauthorized database operations, but requires advanced skills and specific conditions.
Recommendation
It is recommended to apply available patches or update to a version that includes the fix, and restrict access to the admin panel.
Other vulnerabilities in Zen Cart
See all- CVE-2026-108829Medium
A SQL injection vulnerability was discovered in Zen Cart up to 2.2.2, affecting admin/modules.php of the Module Configuration component, via manipulation of the configuration argument. The attack can be launched remotely, and the exploit is publicly available. Patch identified as 08f572654edee1db8f9db091c9949825c6c69339.
- CVE-2026-108827Medium
A code injection vulnerability was identified in Zen Cart up to 2.2.2, affecting the zen_call_function function of admin/includes/functions/general.php in the Administrative Module Management component, via manipulation of the use_function argument. The attack can be launched remotely, has high complexity, and is difficult to exploit. The exploit has been publicly disclosed. The vendor states they do not consider this an independently exploitable vulnerability.
- CVE-2026-108826High
A vulnerability was found in Zen Cart up to version 2.2.2, affecting the zen_db_perform function in includes/modules/payment/paypaldp.php of the PayPal IPN Handler component. Manipulation of the txn_id argument leads to SQL injection, and the attack can be initiated remotely. The exploit has been made public.
- CVE-2015-8352Critical
Directory traversal vulnerability in Zen Cart 1.5.4 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the act parameter to ajax.php.
Original NVD description (English source)
A vulnerability was identified in Zen Cart 2.2.2. Affected by this vulnerability is the function eval of the file admin/configuration.php of the component Admin Panel. The manipulation of the argument gID leads to sql injection. The attack may be initiated remotely. The attack is considered to have high complexity. The exploitation appears to be difficult. The exploit is publicly available and might be used. The vendor explains: "`set_function`/`use_function` are not editable through any normal admin UI (only at plugin-install time via SQL, or via direct database access)".
Vulnerability data from NVD (NIST) · CISA KEV · EPSS