Description

A vulnerability was found in Zen Cart up to 2.2.2. This impacts the function zen_db_perform in the library includes/modules/payment/paypaldp.php of the component PayPal IPN Handler. Performing a manipulation of the argument txn_id results in sql injection. The attack can be initiated remotely. The exploit has been made public and could be used. The patch is named 557154f4fa025f51553094f47b06aa024220c48f. It is suggested to install a patch to address this issue.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.3",
  "pubDate": "2026-10-12T11:17:10.910Z",
  "pubdate": "2026-10-12T11:17:10.910Z",
  "executiveSummary": "A critical SQL injection vulnerability exists in Zen Cart versions up to 2.2.2 within the PayPal IPN Handler component.\nThe vulnerability resides in the zen_db_perform function located in includes/modules/payment/paypaldp.php, where the txn_id argument is processed without adequate sanitization or parameterization.\nThis flaw allows remote, unauthenticated attackers to execute arbitrary SQL commands against the backend database, potentially leading to unauthorized data access, modification, or destruction.\nThe risk is elevated due to the public availability of exploit code, making the vulnerability highly attractive for automated and targeted attacks.\nGiven the nature of the PayPal IPN (Instant Payment Notification) mechanism, this vulnerability is network-exposed by design, requiring no prior authentication to exploit.",
  "technicalDetails": "The root cause of this vulnerability is improper neutralization of special elements used in an SQL command within the zen_db_perform function, found in the file includes/modules/payment/paypaldp.php. This function is responsible for executing database operations based on the transaction data received from PayPal IPN requests.\nSpecifically, the txn_id parameter is ingested from the incoming HTTP request and passed directly into the database query construction process without sufficient input validation or the use of prepared statements.\nAn attacker can exploit this by crafting a malicious payload within the txn_id field of a crafted PayPal IPN notification. Because the PayPal IPN handler is designed to process notifications from external sources, the application is inherently exposed to remote, unauthenticated input.\nWhen the vulnerable code constructs the SQL query, the attacker-supplied payload breaks out of the intended data context, allowing the injection of arbitrary SQL syntax. This enables the attacker to manipulate the query logic, for example, by using UNION-based techniques to extract data from other tables, performing blind SQL injection to infer data, or executing stacked queries if the database configuration permits.\nThe attack flow proceeds as follows: 1) The attacker identifies the publicly available exploit mechanism for this specific endpoint. 2) The attacker sends a crafted request to the PayPal IPN handler containing malicious SQL syntax within the txn_id parameter. 3) The application, failing to sanitize the input, executes the modified SQL query against the database. 4) The database processes the injected commands, returning results or altering its state according to the attacker's instructions.\nPost-exploitation impact includes the full compromise of database integrity and confidentiality. Attackers could potentially extract administrative credentials, bypass authentication mechanisms, or leverage the database access to gain further persistence within the server environment. The severity is compounded by the fact that the exploit is currently public, facilitating easy integration into automated exploitation frameworks."
}