CVE-2008-6985: Zen-Cart Zen Cart

Medium severity, CVSS 6.8. EPSS: 1.6% chance of exploitation in the next 30 days.

Multiple SQL injection vulnerabilities in includes/classes/shopping_cart.php in Zen Cart 1.2.0 through 1.3.8a, when magic_quotes_gpc is disabled, allow remote attackers to execute arbitrary SQL commands via the id parameter when (1) adding or (2) updating the shopping cart.

Affected products

• Zen-Cart Zen Cart: version 1.2.0d only; version 1.2.1_patch1 only; version 1.2.1d only; version 1.2.2d only; version 1.2.3d only; version 1.2.4.1 only; …

Published 2009-08-19. Last modified 2026-06-16.