EIP-2026-110268
PRE-CVEOpenCart 2.1.0.2 < 2.2.0.0 - json_decode Function Remote Code Execution
Title source: legacyExploitation Summary
EIP tracks 1 public exploit for EIP-2026-110268. PoCs published by Naser Farhadi.
AI-analyzed exploit summary This exploit leverages a vulnerability in OpenCart's json_decode function in /upload/system/helper/json.php, where improper sanitization allows PHP code injection. The exploit demonstrates RCE by injecting malicious payloads into user-controlled fields, which are executed when processed by the vulnerable function.
Description
OpenCart 2.1.0.2 < 2.2.0.0 - json_decode Function Remote Code Execution
Exploits (1)
This exploit leverages a vulnerability in OpenCart's json_decode function in /upload/system/helper/json.php, where improper sanitization allows PHP code injection. The exploit demonstrates RCE by injecting malicious payloads into user-controlled fields, which are executed when processed by the vulnerable function.