CVE-2026-108826: Zen Cart PayPal IPN paypaldp.php zen_db_perform sql injection
A vulnerability was found in Zen Cart up to 2.2.2. This impacts the function zendbperform in the library includes/modules/payment/paypaldp.php of the component PayPal IPN Handler. Performing a manipulation of the argument txnid results in sql injection. The attack can be initiated remotely. The exploit has been made public and could be used. The patch is named 557154f4fa025f51553094f47b06aa024220c48f. It is suggested to install a patch to address this issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Zen Cartto a version that resolves this vulnerability.Patch 557154f4fa025f51553094f47b06aa024220c48f
Event History
Frequently Asked Questions
Which deployments are affected?
Zen Cart versions up to and including 2.2.2 are affected where the PayPal IPN Handler component uses includes/modules/payment/paypaldp.php.
What does an attacker need to exploit this issue?
The attack can be initiated remotely without stated authentication or user interaction requirements. Exploitation involves manipulating the txn_id argument processed by the PayPal IPN Handler.
Is public exploit information available?
Yes. The exploit has been made public and could be used.
What should be done to remediate the issue?
Install the patch identified as 557154f4fa025f51553094f47b06aa024220c48f.