Zen Cart CVE-2026-108828

Exploitation requires the attacker to control the set_function/use_function values that feed the gID argument in admin/configuration.php. Per the vendor, these are NOT editable through any normal Zen Cart admin UI and can only be set at plugin-install time via SQL or through direct database access - effectively requiring pre-existing database write access or equivalent high administrative privilege. This precondition (reflected as PR:H/AC:H) is the primary limiting factor and means default, properly-configured installations are not remotely exploitable by ordinary authenticated users or anonymous attackers.

This is a low-priority issue despite the CWE-89 SQL injection classification, and the signals are internally consistent rather than conflicting. The provided CVSS 4.0 vector (AV:N/AC:H/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L) yields a base score of only 2.1, reflecting high attack complexity, high required privileges, and limited impact on all three dimensions. Critically, the vendor explicitly states that the vulnerable set_function/use_function values controlling the gID argument are not editable through any normal admin UI - they are set only at plugin-install time via SQL or through direct database access. That vendor statement corroborates the PR:H/AC:H rating: an attacker who can already write to the database has little need for this injection path. A public exploit (POC) exists via VulDB/GitHub, so publicly available exploit code exists; however, this is NOT the same as active exploitation. There is no CISA KEV listing and no EPSS score was supplied, but given the steep preconditions, real-world mass exploitation is implausible - this is best characterized as a theoretical/low-value finding rather than an operational threat.

An attacker who already holds high administrative privileges and the ability to influence set_function/use_function values (normally only possible at plugin-install time via SQL or via direct database access) could manipulate the gID argument passed to the eval path in admin/configuration.php to inject SQL. Public exploit code is referenced (GHSA-233f-2p5c-vfgw), but the attacker essentially needs pre-existing database/admin write access, making the practical gain marginal.