Vulnerabilidad · Publicado 12/10/2026
Se identificó una vulnerabilidad de inyección SQL en Zen Cart versiones hasta 2.2.2 que afecta la función zen_db_perform en el manejador IPN de PayPal (paypaldp.php). Un atacante puede manipular el parámetro txn_id para ejecutar consultas SQL maliciosas de forma remota. El exploit es público y operativo, impactando directamente tiendas de comercio electrónico en LATAM que procesan pagos con PayPal integrado.
A vulnerability was found in Zen Cart up to 2.2.2. This impacts the function zen_db_perform in the library includes/modules/payment/paypaldp.php of the component PayPal IPN Handler. Performing a manipulation of the argument txn_id results in sql injection. The attack can be initiated remotely. The exploit has been made public and could be used. The patch is named 557154f4fa025f51553094f47b06aa024220c48f. It is suggested to install a patch to address this issue.
Score: 7.3/10 — Severidad: HIGH — Estado NIST: Received
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
CWE-74, CWE-89
Publicado en NIST NVD.