These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
A security flaw has been discovered in Zen Cart up to 2.2.2, specifically in the admin/modules.php file of the Module Configuration component, allowing for SQL injection attacks. The attack may be launched remotely, and a patch has been identified as 08f572654edee1db8f9db091c9949825c6c69339. This vulnerability allows remote attackers to inject SQL code, potentially leading to data breaches or system compr [truncated]
A vulnerability was identified in Zen Cart 2.2.2, affecting the function eval of the file admin/configuration.php of the component Admin Panel. The manipulation of the argument gID leads to sql injection. The attack may be initiated remotely. The attack is considered to have high complexity. The exploitation appears to be difficult. This vulnerability could allow attackers to inject malicious SQL code, po [truncated]
A code injection vulnerability exists in Zen Cart's Administrative Module Management, specifically in the `zen_call_function` of `admin/includes/functions/general.php`. This issue allows remote attackers to inject code by manipulating the `use_function` argument. However, the vendor notes that this is not an independently exploitable vulnerability, as controlling `use_function`/`configuration_value` in th [truncated]
A SQL injection vulnerability was found in Zen Cart's PayPal IPN handler, specifically in the `zen_db_perform` function within `paypaldp.php`. This issue allows remote attackers to manipulate the `txn_id` argument, potentially leading to unauthorized database interactions. The vulnerability has been made public, and a patch (557154f4fa025f51553094f47b06aa024220c48f) is available. Defenders should prioriti [truncated]