Zen Cart is an online store management system. It is PHP-based, using a MySQL database and HTML components. Support is provided for numerous languages and currencies, and it is freely available under the GNU GPL.
Zen Cart v1.3.9f suffers from a persistent cross-site scripting (XSS) and SQL injection vulnerability. The SQLi issue lies in "option_name_manager.php" script in the "option_order_by" parameter thru the admin UI (post-auth). Input is not sanitized resulting in compromising the db system.
The stored/persistent XSS issue lies pretty much everywhere in the admin panel when editing and inserting strings in different categories. Ex:
- In Admin UI go to http://127.0.0.1/admin/record_company.php or Extras > Record Companies and click "insert". Fill out the 1st or 3rd or 4th field or all of them, with the string: "<script>alert("xss")</script>" and click save. Now...every time when you go back to that page it will execute the code for every field.