Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-108828— Zen Cart Admin Panel configuration.php eval sql injection

Quick assessment

Affected
n/a Zen Cart
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 Zen Cart 2.2.2 中发现了安全漏洞。受此漏洞影响的是管理面板（Admin Panel）组件中的 文件内的 函数。通过对参数 的操控，可导致 SQL 注入攻击。该漏洞可能被远程利用，攻击复杂度较高，实际利用难度较大。目前已有公开的 exploit（攻击代码），可能会被攻击者使用。厂商对此说明：“ / 无法通过任何常规的管理后台界面进行编辑（仅在插件安装时通过 SQL 语句或直接数据库访问时才可修改）。”

CVSS 4.1 · Medium EPSS 0.28% · P19

Affected Version Matrix 1

VendorProduct Version RangeStatus
n/a Zen Cart 2.2.2 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-108828

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Zen Cart Admin Panel configuration.php eval sql injection
Source: CVE Program / CVE List V5
Vulnerability Description
A vulnerability was identified in Zen Cart 2.2.2. Affected by this vulnerability is the function eval of the file admin/configuration.php of the component Admin Panel. The manipulation of the argument gID leads to sql injection. The attack may be initiated remotely. The attack is considered to have high complexity. The exploitation appears to be difficult. The exploit is publicly available and might be used. The vendor explains: "`set_function`/`use_function` are not editable through any normal admin UI (only at plugin-install time via SQL, or via direct database access)".
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
SQL命令中使用的特殊元素转义处理不恰当(SQL注入)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
- Zen Cart 2.2.2 cpe:2.3:a:zen_cart:zen_cart:*:*:*:*:*:*:*:*

II. Public POCs for CVE-2026-108828

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-108828

请登录查看更多情报信息。

Security Blog Posts for CVE-2026-108828 (1)

Same Patch Batch · n/a · 2026-10-12 · 12 CVEs total

CVE-2026-108836 7.3 HIGH Ollama Pull API name.go IsValid server-side request forgery
CVE-2026-108826 7.3 HIGH Zen Cart PayPal IPN paypaldp.php zen_db_perform sql injection
CVE-2026-108812 6.5 MEDIUM SEMCMS SEMCMS_User.php user improper authorization
CVE-2026-108824 6.3 MEDIUM DataEase Utils.java Utils.buildCalcField sql injection
CVE-2026-108814 6.3 MEDIUM SEMCMS SEMCMS_Banner.php sql injection
CVE-2026-108813 6.3 MEDIUM SEMCMS SEMCMS_Download.php sql injection
CVE-2026-108822 5.3 MEDIUM Kamailio sipt ss7_parser.c isup_get_calling_party buffer overflow
CVE-2026-108829 4.7 MEDIUM Zen Cart Module Configuration modules.php sql injection
CVE-2026-108811 4.3 MEDIUM WMCMS index.php information disclosure
CVE-2026-108827 4.1 MEDIUM Zen Cart Administrative Module Management general.php zen_call_function code injection
CVE-2026-108815 3.5 LOW idcCMS member_deal.php cross site scripting

IV. Related Vulnerabilities

Same product: Zen Cart
Same vendor: n/a
Same weakness: CWE-89

V. Comments for CVE-2026-108828

No comments yet

Leave a comment