Zen Cart vulnerabilities

A SQL injection vulnerability was discovered in Zen Cart up to 2.2.2, affecting admin/modules.php of the Module Configuration component, via manipulation of the configuration argument. The attack can be launched remotely, and the exploit is publicly available. Patch identified as 08f572654edee1db8f9db091c9949825c6c69339.

A SQL injection vulnerability was identified in Zen Cart 2.2.2, affecting the eval function of admin/configuration.php in the Admin Panel component, via manipulation of the gID argument. The attack can be initiated remotely, has high complexity, and is difficult to exploit. The exploit is publicly available. The vendor explains that set_function/use_function are not editable through any normal admin UI.

A code injection vulnerability was identified in Zen Cart up to 2.2.2, affecting the zen_call_function function of admin/includes/functions/general.php in the Administrative Module Management component, via manipulation of the use_function argument. The attack can be launched remotely, has high complexity, and is difficult to exploit. The exploit has been publicly disclosed. The vendor states they do not consider this an independently exploitable vulnerability.

A vulnerability was found in Zen Cart up to version 2.2.2, affecting the zen_db_perform function in includes/modules/payment/paypaldp.php of the PayPal IPN Handler component. Manipulation of the txn_id argument leads to SQL injection, and the attack can be initiated remotely. The exploit has been made public.

Directory traversal vulnerability in Zen Cart 1.5.4 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the act parameter to ajax.php.