The vulnerability is an SQL injection originating from the admin/modules.php file within the Zen Cart Module Configuration component. Manipulation of the configuration argument allows an attacker to inject arbitrary SQL code into the back‑end database, granting remote attackers the ability to read, modify, or delete data stored in Zen Cart, potentially breaching customer records and compromising the integrity of the application.

Customers running Zen Cart versions 2.2.2 or earlier are affected. The issue resides in the admin/modules.php file of the Module Configuration module. Any deployment that has not applied the patch identified by commit 08f572654edee1db8f9db091c9949825c6c69339 remains vulnerable.

The CVSS score of 5.1 indicates a moderate severity, and although the EPSS score is unavailable, the public release of an exploit demonstrates that it can be leveraged in the wild. The vulnerability is exploitable remotely via the web interface, and it is not listed in the KEV catalog. Attackers can use the flaw to compromise data integrity and confidentiality with relative ease given the publicly available exploit.