Zen Cart 2.2.2 Admin RCE via Unsafe Dynamic Function Call in Use Function

Vulnerability Overview Zen Cart 2.2.2 contains a Remote Code Execution (RCE) vulnerability caused by the use of an insecure dynamic function call mechanism within the administration module management component. An attacker can modify the and columns in the database to pass arbitrary PHP functions and their arguments to the function, thereby executing arbitrary system commands. Affected Scope Affected Version: Zen Cart 2.2.2 Affected Component: Administration module management component Attacker Privileges: Requires administrator privileges or the ability to modify the database via methods such as SQL injection Remediation 1. Avoid insecure dynamic function calls: Avoid directly using the function in the code; instead, use safer alternatives. 2. Input validation and filtering: Strictly validate and filter all user inputs to prevent malicious data injection. 3. Access control: Restrict database access permissions to ensure that only authorized users can modify critical configuration items. 4. Regular updates and patches: Timely apply security patches and updates released by the vendor to fix known vulnerabilities. Proof of Concept (PoC) Manual Exploitation Steps 1. Log in to the Zen Cart admin panel. 2. Inject payload using the SQL Patch tool ( ): 3. Navigate to the Shipping Modules page: 4. will be triggered during page rendering, executing 5. Check for the command output. Exploitation Script ( ) Impact This vulnerability allows authenticated administrators (or attackers capable of modifying the database) to execute arbitrary system commands on the server. This could lead to full control of the web server, data leakage, and potential persistent access. Weakness CWE-94: Improper Control of Generation of Code ('Code Injection')

Goal Reached Thanks to every supporter — we hit 100%!

Zen Cart 2.2.2 Admin RCE via Unsafe Dynamic Function Call in Use Function