CVE-2026-108827: Code Injection in Zen Cart

This vulnerability in Zen Cart up to version 2.2.2 allows potential code injection through the zen_call_function in the administrative module management. The attack vector involves manipulating the use_function argument, but exploitation depends on prior ability to control the configuration table entries, which is only possible through the SQL Patch tool or an existing SQL injection vulnerability. The vulnerability is considered difficult to exploit and is not independently exploitable. No known exploits are reported in the wild.

If exploited, this vulnerability could allow an attacker to inject code remotely. However, due to the requirement of prior control over the configuration table via SQL Patch tool or an existing SQL injection vulnerability, the direct impact is limited. The CVSS score of 2.1 reflects a low severity with high attack complexity and required privileges. No known active exploitation has been reported.

No official patch or fix is indicated in the provided data. Since the vendor states this vulnerability is not independently exploitable and requires prior access through other vulnerabilities or tools, remediation should focus on preventing or fixing any underlying SQL injection vulnerabilities and restricting access to administrative tools like the SQL Patch tool. Monitor vendor advisories for any updates regarding patches or official fixes.