A vulnerability was determined in Zen Cart up to 2.2.2. Affected is the function zen_call_function of the file admin/includes/functions/general.php of the component Administrative Module Management. Executing a manipulation of the argument use_function can lead to code injection.
The attack can be launched remotely. Attacks of this nature are highly complex. The exploitability is told to be difficult.
The exploit has been publicly disclosed and may be utilized. The vendor explains: "We don't consider this an independently exploitable vulnerability. The only path to controlling `use_function`/`configuration_value` in the `configuration` table is the SQL Patch tool (raw arbitrary SQL execution) or a pre-existing SQL injection elsewhere".
Attack Parameters
Attack Vector
Network
Can be exploited remotely
Attack Complexity
High
Difficult to exploit
Attack Requirements
None
No additional conditions
Privileges Required
High
Admin privileges needed
User Interaction
None
No user interaction needed
Impact Assessment
Confidentiality
Low
Partial data leak
Integrity
Low
Partial data modification
Availability
Low
Partial disruption
CVSS Vector v4.0
Weakness Type (CWE)
Vulnerable Products
n/a:zen cart
References 5
https://vuldb.com/vuln/416603
VDB-416603 | Zen Cart Administrative Module Management general.php zen_call_function code injection
https://vuldb.com/vuln/416603/cti
VDB-416603 | CTI Indicators (IOB, IOC, TTP, IOA)
https://vuldb.com/cve/CVE-2026-108827
CVE-2026-108827 | CVE Analysis and Report
https://vuldb.com/submit/883881
Submit #883881 | Zen Cart 2.2.2 Code Injection
https://cdkkx.github.io/posts/GHSA-xrv3-wg8v-w8q8.html
NVD