CVE-2024-58304
HIGHSPA-CART CMS 1.9.0.3 - Authenticated Stored Cross-Site Scripting via Product Description Parameter
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2024-58304. PoCs published by Eren Sen.
AI-analyzed exploit summary This is a proof-of-concept for a stored XSS vulnerability in SPA-CART CMS version 1.9.0.3. The exploit demonstrates how an attacker can inject malicious JavaScript into the 'descr' parameter, which is then stored and executed when accessed.
Description
SPA-CART CMS 1.9.0.3 contains a stored cross-site scripting vulnerability in the product description parameter that allows authenticated administrators to inject malicious scripts. Attackers can submit JavaScript payloads through the 'descr' parameter in the product edit form to execute arbitrary code in administrative users' browsers.
Exploits (1)
This is a proof-of-concept for a stored XSS vulnerability in SPA-CART CMS version 1.9.0.3. The exploit demonstrates how an attacker can inject malicious JavaScript into the 'descr' parameter, which is then stored and executed when accessed.
References (2)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N