PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-108827 Zen Cart CVE debrief

A code injection vulnerability exists in Zen Cart's Administrative Module Management, specifically in the `zen_call_function` of `admin/includes/functions/general.php`. This issue allows remote attackers to inject code by manipulating the `use_function` argument. However, the vendor notes that this is not an independently exploitable vulnerability, as controlling `use_function`/`configuration_value` in the `configuration` table requires either the SQL Patch tool or a pre-existing SQL injection.

Vendor
Zen Cart
Product
Zen Cart
CVSS
LOW 1.2
CISA KEV
Not listed in stored evidence
Original CVE published
2026-10-12
Original CVE updated
2026-10-12
Advisory published
2026-10-12
Advisory updated
2026-10-12

Who should care

Defenders responsible for Zen Cart installations, particularly those with Administrative Module Management enabled, should assess exposure and verify the integrity of their configurations.

Why it matters

This vulnerability allows remote code injection in Zen Cart's Administrative Module Management. While not independently exploitable, it requires defenders to verify configuration integrity and monitor for SQL injection attempts.

  • Potential code injection requires verification
  • Possible SQL injection attempts need monitoring
  • Configuration table integrity is crucial

Technical summary

The `zen_call_function` in `admin/includes/functions/general.php` of Zen Cart's Administrative Module Management is vulnerable to code injection. The attack involves manipulating the `use_function` argument to inject malicious code. However, the vendor emphasizes that this vulnerability is not independently exploitable without prior SQL injection or use of the SQL Patch tool. Defenders should prioritize verifying the integrity of the `configuration` table and monitoring for potential SQL injection attempts. The vulnerability affects Zen Cart up to version 2.2.2.

Defensive priority

Defenders should prioritize verifying the integrity of the `configuration` table and monitoring for potential SQL injection attempts.

Recommended defensive actions

  • Verify the integrity of the `configuration` table
  • Monitor for potential SQL injection attempts
  • Assess exposure of Zen Cart installations
  • Review compensating controls for exposed systems
  • Check relevant monitoring, detection, and logs for exposed assets
  • Track exceptions, retest remediated assets
  • Plan vendor-supported updates or mitigations

Evidence notes

The CVE Program record and NVD vulnerability detail provide official information on the vulnerability. Supplemental sources, such as Vuldb, offer additional technical descriptions and indicators. Defenders should verify configuration integrity, monitor for SQL injection attempts, and assess exposure of Zen Cart installations. The evidence is based on CVE and NVD records, which may have limitations in their details.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-108827 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-108827

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-108827 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-108827

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Zen Cart Administrative Module Management general.php zen_call_function code injection

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/108xxx/CVE-2026-108827.json

    cve_program_cvelist_v5

  • Source reference

    Unverified legacy reference

    URL: https://vuldb.com/vuln/416603

    Supplemental source - vdb-entry, technical-description

  • Source reference

    Unverified legacy reference

    URL: https://vuldb.com/vuln/416603/cti

    Supplemental source - signature, permissions-required

  • Source reference

    Unverified legacy reference

    URL: https://vuldb.com/cve/CVE-2026-108827

    Supplemental source - third-party-advisory

  • Source reference

    Unverified legacy reference

    URL: https://vuldb.com/submit/883881

    Supplemental source - third-party-advisory

  • Source reference

    Unverified legacy reference

    URL: https://cdkkx.github.io/posts/GHSA-xrv3-wg8v-w8q8.html

    Supplemental source - exploit

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.