CVE-2011-4567
Zen Cart < 1.5 - Cross-Site Scripting via Message Parameter in Gift Voucher Send
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2011-4567. PoCs published by RPinto.
AI-analyzed exploit summary The exploit demonstrates a stored XSS vulnerability in Zen Cart 1.3.9h by injecting malicious JavaScript via the 'message' parameter in a POST request to the 'gv_send' page. The vulnerability arises due to insufficient input sanitization, allowing arbitrary script execution in the context of the affected site.
Description
Cross-site scripting (XSS) vulnerability in includes/templates/template_default/templates/tpl_gv_send_default.php in Zen Cart before 1.5 allows remote attackers to inject arbitrary web script or HTML via the message parameter in a gv_send action to index.php, a different vulnerability than CVE-2011-4547.
Exploits (1)
The exploit demonstrates a stored XSS vulnerability in Zen Cart 1.3.9h by injecting malicious JavaScript via the 'message' parameter in a POST request to the 'gv_send' page. The vulnerability arises due to insufficient input sanitization, allowing arbitrary script execution in the context of the affected site.