CVE-2026-108826: Zencart Sql Injection Tainted Db Perform Where Clausecve-2026-108826-zencart-sql-injection-tainted-db-perform-where-clause
zen_db_perform() interpolates its 4th argument verbatim as the WHERE clause of the generated UPDATE (only the values of the $data array are escaped). Concatenating a request superglobal ($_POST/$_GET/$_REQUEST/$_COOKIE) directly into that argument — e.g. "txn_id='" . $_POST['txn_id'] . "'" — turns a forged request into executable SQL: arbitrary row selection
