Exploitation Summary
EIP tracks 1 public exploit for CVE-2014-3868. PoCs published by Kenny Mathis.
AI-analyzed exploit summary The exploit demonstrates an SQL injection vulnerability in ZeusCart 4.0 by injecting a sleep command into the 'prodid' parameter. This confirms the vulnerability by delaying the response, indicating successful exploitation.
Description
Multiple SQL injection vulnerabilities in ZeusCart 4.x.
Exploits (1)
exploitdb
WORKING POC
VERIFIED
by Kenny Mathis · textwebappsphp
https://www.exploit-db.com/exploits/39223
The exploit demonstrates an SQL injection vulnerability in ZeusCart 4.0 by injecting a sleep command into the 'prodid' parameter. This confirms the vulnerability by delaying the response, indicating successful exploitation.
Classification
Working Poc 90%
Attack Type
Sqli
Complexity
Trivial
Reliability
Reliable
Target:
ZeusCart 4.0
No auth needed
Prerequisites:
Access to the target application's URL
MITRE ATT&CK
mistral-large-3 · analyzed Feb 18, 2026
Full analysis →
References (4)
Core 4
Core References
Exploit, Patch, Third Party Advisory, VDB Entry x_refsource_misc
http://packetstormsecurity.com/files/127196/ZeusCart-4.x-Remote-SQL-Injection.html
Patch, Third Party Advisory x_refsource_misc
https://github.com/ZeusCart/zeuscart/pull/23
Exploit, Mailing List, Patch, Third Party Advisory x_refsource_misc
http://seclists.org/fulldisclosure/2014/Jun/116
Third Party Advisory, VDB Entry x_refsource_misc
http://www.securityfocus.com/bid/68182
Scores
CVSS v3
8.8
EPSS
0.0246
EPSS Percentile
82.5%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Details
CWE
CWE-89
Status
published
Products (1)
zeuscart/zeuscart
4.0
Published
Jan 31, 2020
Tracked Since
Feb 18, 2026