Zen Cart version 2.2.2 contains a flaw in the admin/configuration.php file where an eval function processes the gID parameter supplied to the Admin Panel. The gID value is passed to the eval call without proper sanitization, allowing attackers to inject arbitrary SQL statements. This flaw enables unauthorized read or modification of database data, potentially leading to escalation of privileges within the application. The vulnerability is an example of input‑validation and SQL injection weaknesses, identified as CWE-74 and CWE-89.

The affected platform is the Zen Cart e‑commerce application, specifically the Admin Panel component of version 2.2.2. The defect lies in the eval implementation inside configuration.php and concerns manipulation of the gID argument by administrators or external callers.

The base CVSS score of 2.1 indicates a low overall severity, yet the vulnerability can be triggered remotely and is noted as having high complexity and a difficult exploitation path. The EPSS score is not available, and it is not listed in the CISA KEV catalog, implying it was not actively weaponized at the time of reporting. Nevertheless, publicly available exploit code exists, meaning that an attacker with remote admin panel access could potentially compromise the database. Although the threat is confined to data manipulation rather than system takeover, the possibility of unauthorized access warrants attention.