SQL Injection in Zen Cart PayPal IPN Handler

A SQL injection vulnerability (CVE-2026-108826) has been identified in Zen Cart versions up to 2.2.2. The flaw resides in the 'zen_db_perform' function within the 'includes/modules/payment/paypaldp.php' file, which is part of the PayPal IPN Handler component. An unauthenticated remote attacker can exploit this by manipulating the 'txn_id' argument supplied to the handler. Successful exploitation allows for the execution of arbitrary SQL queries, which could lead to data exfiltration, unauthorized modification of database contents, or further application compromise. The vulnerability is confirmed to have public exploit code available, and a patch is available via commit 557154f4fa025f51553094f47b06aa024220c48f.

Impact

The vulnerability poses a high risk to merchants utilizing the affected versions of Zen Cart. If successfully exploited, the database containing customer information, transaction history, and potentially administrative credentials could be fully compromised. This impacts the confidentiality and integrity of e-commerce data for organizations running this specific version of the payment module.

Recommendation

Prioritized actions for security and infrastructure teams:

• Patch the Zen Cart installation by applying the fix provided in commit 557154f4fa025f51553094f47b06aa024220c48f immediately.
• Review web server access logs for anomalous POST requests directed at the 'includes/modules/payment/paypaldp.php' file containing suspicious characters in the 'txn_id' parameter, such as single quotes, semicolons, or SQL keywords.
• Audit database query logs for unauthorized or unexpected queries originating from the web application user, particularly those that correlate with the access patterns observed for the vulnerable script.