CVE-2026-108827: Zen Cart Administrative Module Management general.php zen_call_function code injection
A vulnerability was determined in Zen Cart up to 2.2.2. Affected is the function zencallfunction of the file admin/includes/functions/general.php of the component Administrative Module Management. Executing a manipulation of the argument usefunction can lead to code injection. The attack can be launched remotely. Attacks of this nature are highly complex. The exploitability is told to be difficult. The exploit has been publicly disclosed and may be utilized. The vendor explains: "We don't consider this an independently exploitable vulnerability. The only path to controlling usefunction/configurationvalue in the configuration table is the SQL Patch tool (raw arbitrary SQL execution) or a pre-existing SQL injection elsewhere".
Affected Software
Event History
Frequently Asked Questions
Who is realistically exposed to this issue?
Exposure is limited to Zen Cart installations up to 2.2.2 where an attacker can already control use_function or configuration_value entries in the configuration table. The vendor states that this requires either use of the SQL Patch tool for raw arbitrary SQL execution or a separate pre-existing SQL injection vulnerability.
Can an unauthenticated remote attacker exploit this directly through Administrative Module Management?
The issue is described as remotely launchable, but the vendor does not consider it independently exploitable. Controlling the relevant database values requires an existing arbitrary-SQL capability or another SQL injection path.
What should be prioritized if patching is not immediately possible?
Prioritize preventing and investigating arbitrary SQL execution, including access to the SQL Patch tool and any existing SQL injection weaknesses. Restrict administrative access because the affected component is Administrative Module Management.
How difficult is exploitation and is exploit code available?
Exploitation is rated high complexity and difficult. A public exploit has been disclosed and may be used.