Zen Cart EUVD-2026-97352

Requires an authenticated Zen Cart administrator session with access to the Module Configuration interface (admin/modules.php); the attacker manipulates the module 'configuration' key, which is concatenated unsanitized into a SELECT ... WHERE configuration_key = '...' query. Exploitation is strictly gated by admin-level authentication (CVSS PR:H) - it is not reachable by unauthenticated or low-privileged users - and applies to Zen Cart versions up to and including 2.2.2 prior to commit 08f572654edee1db8f9db091c9949825c6c69339. The limiting factor is that only accounts already holding backend admin privileges can reach the vulnerable code path.

This is a genuine but lower-priority SQL injection. The strongest mitigating signal is the CVSS 4.0 vector PR:H (CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N, score 5.1), which places the flaw inside the administrative backend (admin/modules.php, Module Configuration) and therefore requires an authenticated high-privilege operator - the same role that already has legitimate database-affecting access. VulDB rates all impact metrics as Low (VC:L/VI:L/VA:L), consistent with an injection point in a configuration_key SELECT rather than an unauthenticated data-exfiltration vector. The exploit maturity is E:P (proof-of-concept), matching the POC=YES/KEV=NO signals: public exploit code exists (cdkkx.github.io GHSA writeup) but there is no evidence of active exploitation - do not treat this as in-the-wild. No EPSS score and no SSVC decision data were supplied, so automatability and real-world exploitation probability cannot be quantified from the input. The source diff confirms the root cause: unsanitized $key concatenated into the WHERE clause, fixed by wrapping it in zen_db_input(). Net: a real, patch-worthy flaw, but the PR:H precondition makes it an insider/post-compromise concern rather than an internet-facing emergency.

An attacker who has already obtained Zen Cart administrator credentials (or hijacked an admin session) navigates to the Module Configuration page and submits a crafted configuration key value that breaks out of the SQL string in admin/modules.php, allowing arbitrary SQL to run against the store database. Public proof-of-concept exploit code exists (GHSA writeup), lowering the effort to reproduce, though the network attack (AV:N, AC:L) still requires valid high-privilege admin authentication (PR:H).