Description
A vulnerability was identified in Zen Cart 2.2.2. Affected by this vulnerability is the function eval of the file admin/configuration.php of the component Admin Panel. The manipulation of the argument gID leads to sql injection. The attack may be initiated remotely. The attack is considered to have high complexity. The exploitation appears to be difficult. The exploit is publicly available and might be used. The vendor explains: "`set_function`/`use_function` are not editable through any normal admin UI (only at plugin-install time via SQL, or via direct database access)".
Published: 2026-10-12
Score: 2.1 Low
EPSS: n/a
KEV: No
AI Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Remediation

No vendor fix or workaround currently provided.

Additional remediation guidance may be available on OpenCVE Cloud.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 12 Oct 2026 11:30:00 +0000

Type Values Removed Values Added
Description A vulnerability was identified in Zen Cart 2.2.2. Affected by this vulnerability is the function eval of the file admin/configuration.php of the component Admin Panel. The manipulation of the argument gID leads to sql injection. The attack may be initiated remotely. The attack is considered to have high complexity. The exploitation appears to be difficult. The exploit is publicly available and might be used. The vendor explains: "`set_function`/`use_function` are not editable through any normal admin UI (only at plugin-install time via SQL, or via direct database access)".
Title Zen Cart Admin Panel configuration.php eval sql injection
First Time appeared Zen Cart
Zen Cart zen Cart
Weaknesses CWE-74
CWE-89
CPEs cpe:2.3:a:zen_cart:zen_cart:*:*:*:*:*:*:*:*
Vendors & Products Zen Cart
Zen Cart zen Cart
References
Metrics cvssV2_0

{'score': 4.3, 'vector': 'AV:N/AC:H/Au:M/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 4.1, 'vector': 'CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 4.1, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 2.1, 'vector': 'CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Zen Cart Zen Cart
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-10-12T11:15:05.037Z

Reserved: 2026-10-11T11:09:44.262Z

Link: CVE-2026-108828

cve-icon Vulnrichment

No data.

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses
  • CWE-74

    Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')