{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3azen-cartzen_cart/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:zen-cart:zen_cart:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.3,"id":"CVE-2026-108826"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Zen Cart (\u003c= 2.2.2)"],"_cs_severities":["high"],"_cs_tags":["web-application-vulnerability","sql-injection","e-commerce"],"_cs_type":"advisory","_cs_vendors":["Zen Cart"],"content_html":"\u003cp\u003eA SQL injection vulnerability (CVE-2026-108826) has been identified in Zen Cart versions up to 2.2.2. The flaw resides in the 'zen_db_perform' function within the 'includes/modules/payment/paypaldp.php' file, which is part of the PayPal IPN Handler component. An unauthenticated remote attacker can exploit this by manipulating the 'txn_id' argument supplied to the handler. Successful exploitation allows for the execution of arbitrary SQL queries, which could lead to data exfiltration, unauthorized modification of database contents, or further application compromise. The vulnerability is confirmed to have public exploit code available, and a patch is available via commit 557154f4fa025f51553094f47b06aa024220c48f.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe vulnerability poses a high risk to merchants utilizing the affected versions of Zen Cart. If successfully exploited, the database containing customer information, transaction history, and potentially administrative credentials could be fully compromised. This impacts the confidentiality and integrity of e-commerce data for organizations running this specific version of the payment module.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003ePrioritized actions for security and infrastructure teams:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003ePatch the Zen Cart installation by applying the fix provided in commit 557154f4fa025f51553094f47b06aa024220c48f immediately.\u003c/li\u003e\n\u003cli\u003eReview web server access logs for anomalous POST requests directed at the 'includes/modules/payment/paypaldp.php' file containing suspicious characters in the 'txn_id' parameter, such as single quotes, semicolons, or SQL keywords.\u003c/li\u003e\n\u003cli\u003eAudit database query logs for unauthorized or unexpected queries originating from the web application user, particularly those that correlate with the access patterns observed for the vulnerable script.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-12T11:42:36Z","date_published":"2026-10-12T11:42:36Z","id":"https://feed.craftedsignal.io/briefs/2026-10-zen-cart-sqli/","summary":"A remote SQL injection vulnerability in the Zen Cart PayPal IPN Handler component allows unauthenticated attackers to execute arbitrary SQL commands via the txn_id parameter.","title":"SQL Injection in Zen Cart PayPal IPN Handler","url":"https://feed.craftedsignal.io/briefs/2026-10-zen-cart-sqli/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:zen-Cart:zen_cart:*:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}