Description
A vulnerability was determined in Zen Cart up to 2.2.2. Affected is the function zen_call_function of the file admin/includes/functions/general.php of the component Administrative Module Management. Executing a manipulation of the argument use_function can lead to code injection. The attack can be launched remotely. Attacks of this nature are highly complex. The exploitability is told to be difficult. The exploit has been publicly disclosed and may be utilized. The vendor explains: "We don't consider this an independently exploitable vulnerability. The only path to controlling `use_function`/`configuration_value` in the `configuration` table is the SQL Patch tool (raw arbitrary SQL execution) or a pre-existing SQL injection elsewhere".
Published: 2026-10-12
Score: 2.1 Low
EPSS: < 1% Very Low
KEV: No
Impact: Code Injection
Action: Assess
AI Analysis

Impact

The vulnerability resides in Zen Cart’s Administrative Module Management component, specifically the zen_call_function routine in admin/includes/functions/general.php. By supplying a crafted use_function argument, an attacker who can influence that input can inject arbitrary PHP code into the site, enabling remote code execution. The flaw corresponds to the weaknesses CWE‑74 (Improper Neutralization of Input) and CWE‑94 (Improper Control of Generation of Code by a Process).

Affected Systems

Zen Cart releases up to version 2.2.2 are impacted. The flaw exists in the Administrative Module Management component located in admin/includes/functions/general.php. Any installation of Zen Cart 2.2.2 or earlier that allows administrators to provide a value for the use_function configuration key, or that exposes a mechanism to modify configuration values (such as the SQL Patch tool), could be susceptible.

Risk and Exploitability

The CVSS score of 2.1 indicates low severity. EPSS is not available, and the vulnerability is not listed in the CISA KEV catalog. Vendor notes that controlling the use_function parameter requires either the SQL Patch tool (which allows arbitrary SQL execution) or an existing SQL injection flaw. Because of that dependency, independent exploitation is highly unlikely. The risk to an organization that does not have other injection paths is therefore minimal, but if a database loophole or another vulnerability exists, an attacker could leverage this flaw to execute arbitrary PHP code.

Generated by OpenCVE AI on October 12, 2026 at 12:51 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Zen Cart to a version newer than 2.2.2 that resolves the issue.
  • Secure or disable the SQL Patch tool and patch any existing SQL injection vulnerabilities that could allow tampering with configuration values.
  • If the Administrative Module Management component is not essential, remove or disable it; otherwise restrict the use_function parameter to a whitelist of allowed functions and enforce input validation.

Generated by OpenCVE AI on October 12, 2026 at 12:51 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 10 Nov 2026 21:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 12 Oct 2026 12:45:00 +0000

Type Values Removed Values Added
First Time appeared Zen-cart
Zen-cart zen Cart
Vendors & Products Zen-cart
Zen-cart zen Cart

Mon, 12 Oct 2026 11:30:00 +0000

Type Values Removed Values Added
Description A vulnerability was determined in Zen Cart up to 2.2.2. Affected is the function zen_call_function of the file admin/includes/functions/general.php of the component Administrative Module Management. Executing a manipulation of the argument use_function can lead to code injection. The attack can be launched remotely. Attacks of this nature are highly complex. The exploitability is told to be difficult. The exploit has been publicly disclosed and may be utilized. The vendor explains: "We don't consider this an independently exploitable vulnerability. The only path to controlling `use_function`/`configuration_value` in the `configuration` table is the SQL Patch tool (raw arbitrary SQL execution) or a pre-existing SQL injection elsewhere".
Title Zen Cart Administrative Module Management general.php zen_call_function code injection
First Time appeared Zen Cart
Zen Cart zen Cart
Weaknesses CWE-74
CWE-94
CPEs cpe:2.3:a:zen_cart:zen_cart:*:*:*:*:*:*:*:*
Vendors & Products Zen Cart
Zen Cart zen Cart
References
Metrics cvssV2_0

{'score': 4.3, 'vector': 'AV:N/AC:H/Au:M/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 4.1, 'vector': 'CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 4.1, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 2.1, 'vector': 'CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Zen-cart Zen Cart
Zen Cart Zen Cart
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-10-14T17:35:08.972Z

Reserved: 2026-10-11T11:09:40.964Z

Link: CVE-2026-108827

cve-icon Vulnrichment

Updated: 2026-10-14T17:34:59.467Z

cve-icon NVD

Status : Deferred

Published: 2026-10-12T12:17:14.270

Modified: 2026-10-14T18:17:31.447

Link: CVE-2026-108827

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-12T13:00:15Z

Weaknesses
  • CWE-74

    Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

  • CWE-94

    Improper Control of Generation of Code ('Code Injection')