CVE-2026-108829
4.7MediumPublished 12 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- High
- User interaction
- None
- Impact
- Limited impact
- Weakness
- CWE-74, CWE-89
Impact
Authenticated administrators can perform SQL injection against the backend database using publicly available exploits. They require administrative access to the Zen Cart admin panel and network reachability to the web interface.
Root cause
Improper sanitization of the configuration parameter in admin/modules.php leads to SQL injection.
Affected systems
Zen Cart up to and including 2.2.2
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L
Fix & remediation
Apply Git commit 08f572654edee1db8f9db091c9949825c6c69339 to patch admin/modules.php. If immediate patching is not possible, restrict administrative panel access using IP allowlisting or web server authentication.
$ git cherry-pick 08f572654edee1db8f9db091c9949825c6c69339AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
A security flaw has been discovered in Zen Cart up to 2.2.2. Affected by this issue is some unknown functionality of the file admin/modules.php of the component Module Configuration. The manipulation of the argument configuration results in sql injection. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks. The patch is identified as 08f572654edee1db8f9db091c9949825c6c69339. It is advisable to implement a patch to correct this issue.