CVE-2024-58304
5.3
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
Summary
SPA-CART CMS before 2.0.0 contains a stored cross-site scripting vulnerability in the product description parameter that allows authenticated administrators to inject malicious scripts. Attackers can submit JavaScript payloads through the 'descr' parameter in the product edit form to execute arbitrary code in administrative users' browsers.
Affected Software
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| SPA-Cart | SPA-CART CMS | 0 < 2.0.0 | affected |
Weaknesses
- CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
ADP Enrichment
CISA ADP Vulnrichment
- SSVC:
- Exploitation: poc
- Automatable: no
- Technical Impact: partial
References
- https://github.com/olegkhorev/php-spa-cart/releases/tag/v2.0.0
- https://www.exploit-db.com/exploits/51919
- https://www.vulncheck.com/advisories/spa-cart-cms-stored-cross-site-scripting-via-product-description
Feedback
Was this page helpful?
Glad to hear it! Please tell us how we can improve.
Sorry to hear that. Please tell us how we can improve.