Description

A vulnerability was determined in Zen Cart up to 2.2.2. Affected is the function zen_call_function of the file admin/includes/functions/general.php of the component Administrative Module Management. Executing a manipulation of the argument use_function can lead to code injection. The attack can be launched remotely. Attacks of this nature are highly complex. The exploitability is told to be difficult. The exploit has been publicly disclosed and may be utilized. The vendor explains: "We don't consider this an independently exploitable vulnerability. The only path to controlling `use_function`/`configuration_value` in the `configuration` table is the SQL Patch tool (raw arbitrary SQL execution) or a pre-existing SQL injection elsewhere".

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.1",
  "pubDate": "2026-10-12T12:17:14.270Z",
  "pubdate": "2026-10-12T12:17:14.270Z",
  "executiveSummary": "A code injection vulnerability exists within the Administrative Module Management component of Zen Cart up to version 2.2.2.\nThe vulnerability resides in the zen_call_function function located in admin/includes/functions/general.php.\nBy manipulating the use_function argument, an attacker can achieve arbitrary code execution.\nWhile the attack is theoretically remote, the vendor notes that successful exploitation is highly complex and difficult, requiring prior execution of arbitrary SQL or a pre-existing SQL injection vulnerability to manipulate the configuration table.\nThe risk implication is critical, as successful exploitation results in full unauthorized code execution within the application context, potentially leading to complete system compromise.\nThe vulnerability has been publicly disclosed, necessitating immediate security awareness.",
  "technicalDetails": "The vulnerability is located in the function zen_call_function within the file admin/includes/functions/general.php. This function is designed to handle dynamic function calls based on parameters stored in the configuration table. The primary weakness stems from a lack of strict validation or a whitelist mechanism for the input passed to the use_function argument.\nIn the Zen Cart architecture, the configuration table stores parameters that dictate application behavior, including function hooks used in administrative tasks. The root cause is the ability to pass arbitrary function names to zen_call_function, which are then executed by the PHP interpreter. Because this function does not adequately sanitize or restrict the execution scope, it provides a vector for code injection.\nThe attack flow follows a non-trivial trajectory. Because the administrative module management does not inherently expose these parameters to arbitrary input, exploitation requires a mechanism to populate or modify the 'use_function' column within the 'configuration' database table. As identified by the vendor, this can be achieved through the 'SQL Patch' tool—which requires administrative access—or by leveraging a pre-existing SQL injection vulnerability elsewhere in the application to perform an 'UPDATE' operation on the database.\nOnce the attacker successfully modifies the configuration entry associated with the vulnerable module, the next time the Administrative Module Management component invokes zen_call_function, the manipulated 'use_function' argument is processed. The PHP engine executes the user-supplied string as a function, allowing for arbitrary code execution with the privileges of the web server process.\nThe vulnerability is characterized by a high degree of complexity. It is not considered 'independently exploitable' under standard configurations, as the primary barrier to entry is the requirement to modify the database content. However, once the configuration table is compromised, the attacker can execute arbitrary PHP payloads. This necessitates that security teams prioritize the mitigation of secondary vulnerabilities such as SQL injection to effectively close this path of exploitation."
}