CVE-2026-108829: Zen Cart Module Configuration modules.php sql injection
A security flaw has been discovered in Zen Cart up to 2.2.2. Affected by this issue is some unknown functionality of the file admin/modules.php of the component Module Configuration. The manipulation of the argument configuration results in sql injection. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks. The patch is identified as 08f572654edee1db8f9db091c9949825c6c69339. It is advisable to implement a patch to correct this issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Zen Cartto a version that resolves this vulnerability.Patch 08f572654edee1db8f9db091c9949825c6c69339
Event History
Frequently Asked Questions
What level of access does an attacker need to exploit this issue?
The vulnerability requires high privileges (PR:H). Although it can be launched remotely, the available data indicates an attacker must already have privileged access.
Which installations are affected?
Zen Cart versions up to 2.2.2 are affected, specifically unknown functionality in admin/modules.php related to Module Configuration. The provided data does not state whether a default configuration is vulnerable.
Is exploitation likely in practice?
Public exploit code has been released, and the exploitability assessment is marked as proof-of-concept (E:P). This increases the likelihood of attempted exploitation where attackers can obtain the required privileges.
How should this be remediated?
Apply the patch identified as 08f572654edee1db8f9db091c9949825c6c69339. The supplied information does not provide an alternative mitigation for environments that cannot immediately patch.