This flaw allows an unauthenticated attacker to supply a crafted transaction identifier to Zen Cart’s PayPal IPN handler, causing the internal zen_db_perform function to incorporate unsanitized input into an SQL query. The resulting injection can enable the attacker to read, modify, or delete data in the database, thereby compromising confidentiality and integrity of the store’s data and potentially affecting application availability. The weakness is a classic injection error, classified under CWE‑89 and CWE‑74.

Zen Cart users running version 2.2.2 or earlier are vulnerable when the PayPal IPN module is installed and active. The provided patch commit (557154f4fa025f51553094f47b06aa024220c48f) fixes the issue by properly escaping or parameterizing the transaction identifier. Site administrators should verify that their instance matches one of the affected releases and that the Core code includes the flawed call in paypaldp.php before applying the fix.

The CVSS score of 6.9 rates this vulnerability as medium severity, while EPSS data is currently unavailable. It is not listed in the CISA KEV catalog, but the exploit has been made public, meaning the risk of exploitation for an unpatched system remains high. Attackers can trigger the injection remotely by submitting a crafted txn_id to the PayPal IPN endpoint, making the vulnerability readily exploitable on any exposed Zen Cart installation that uses the affected module.