Zen Cart CVE-2026-108827

Exploitation requires that the attacker can write arbitrary values into the use_function/configuration_value columns of the Zen Cart configuration table, which the vendor states is only reachable through the admin SQL Patch tool (raw arbitrary SQL execution) or a separate pre-existing SQL injection - not through normal unprivileged input. The limiting factors are therefore: administrative access to the SQL Patch tool (or a chained SQLi vulnerability), consistent with PR:H, plus the high attack complexity (AC:H) the record describes as 'difficult.' There is no special non-default feature toggle required beyond having privileged database/admin control; absent that control the flaw is not independently exploitable.

This is a low-priority issue that scores low on nearly every signal, and the signals are internally consistent rather than conflicting. The CVSS 4.0 base score is 2.1 (Low), driven by AC:H (high attack complexity - the input explicitly states 'Attacks of this nature are highly complex' and 'exploitability is told to be difficult') and PR:H (high privileges required). Crucially, the vendor disputes independent exploitability, stating the only way to control the use_function/configuration_value fields is via the SQL Patch tool (which already grants raw arbitrary SQL execution) or a pre-existing SQL injection elsewhere - meaning an attacker who can reach this code path already holds admin-level database control, so the code-injection adds little marginal capability. There is no EPSS score, no SSVC decision data, and no KEV listing provided, so automatability and exploitation-maturity cannot be scored quantitatively; the only elevated signal is that publicly available exploit code exists (CVSS E:P, Proof-of-Concept). Weighing these together: publicly available exploit code exists but there is no evidence of active exploitation, and the high privilege requirement plus vendor-confirmed dependency on pre-existing admin/SQL access make this far closer to a defense-in-depth hardening item than an urgent patch. Treat the raw CVE as low real-world risk unless a separate SQL injection (tagged SQLi) is present in the same environment, which would change the calculus.

An attacker who has already obtained Zen Cart administrator access (or chained a separate SQL injection) writes a malicious payload into the use_function/configuration_value column of the configuration table via the admin SQL Patch tool; when zen_call_function later processes that value, the injected PHP is executed (CWE-94). Publicly available proof-of-concept exploit code exists, but the attack is rated highly complex and depends on pre-existing privileged database control, so it is not a standalone remote compromise.