CVE-2021-32202

CS-Cart 4.11.1 is affected by a cross-site scripting (XSS) vulnerability that can be triggered by manipulating the blog post description field during post creation. The root cause, as described in CNNVD, is insufficient validation/escaping of user input in the post description, enabling copy-past...

CVE-2021-32202: Improper Neutralization of Input During Web Page Generation

In CS-Cart version 4.11.1, it is possible to induce copy-paste XSS by manipulating the "post description" filed in the blog post creation page...

Exploit for CVE-2021-26121

CS-Cart templates.manage Server Side Template Injection Remote...

CS-Cart 1.3.3 Local File Inclusion

Exploit Title: CS-Cart unauthenticated LFI Date: 2020-09-22 Exploit Author: 0xmmnbassel Vendor Homepage: https://www.cs-cart.com/e-commerce-platform.html Tested at: ver. 1.3.4 Vulnerability Type: unauthenticated LFI...

CS-Cart 1.3.3 - 'classes_dir' LFI

Exploit Title: CS-Cart unauthenticated LFI Date: 2020-09-22 Exploit Author: 0xmmnbassel Vendor Homepage: https://www.cs-cart.com/e-commerce-platform.html Tested at: ver. 1.3.4 Vulnerability Type: unauthenticated LFI...

CS-Cart 1.3.3 Remote Code Execution

Exploit Title: CS-Cart authenticated RCE Date: 2020-09-22 Exploit Author: 0xmmnbassel Vendor Homepage: https://www.cs-cart.com/e-commerce-platform.html Tested at: ver. 1.3.3 Vulnerability Type: authenticated RCE get PHP shells from http://pentestmonkey.net/tools/web-shells/php-reverse-shell edit ...

CS-Cart 1.3.3 - authenticated RCE

Exploit Title: CS-Cart authenticated RCE Date: 2020-09-22 Exploit Author: 0xmmnbassel Vendor Homepage: https://www.cs-cart.com/e-commerce-platform.html Tested at: ver. 1.3.3 Vulnerability Type: authenticated RCE get PHP shells from http://pentestmonkey.net/tools/web-shells/php-reverse-shell edit ...

Code injection

The files function in the administration section in CS-Cart 4.6.2 and earlier allows attackers to execute arbitrary PHP code via vectors involving a custom page...

CVE-2017-15673

The files function in the administration section in CS-Cart 4.6.2 and earlier allows attackers to execute arbitrary PHP code via vectors involving a custom page...

CVE-2017-15673

CVE-2017-15673 affects CS-Cart 4.6.2 and earlier. The vulnerability resides in the administration section’s files function, allowing an attacker to upload or craft a custom page that executes arbitrary PHP code, yielding remote code execution on the server. Multiple connected sources corroborate ...

CVE-2017-15673

The files function in the administration section in CS-Cart 4.6.2 and earlier allows attackers to execute arbitrary PHP code via vectors involving a custom page...

CVE-2017-15673: Unrestricted Upload of File with Dangerous Type

The files function in the administration section in CS-Cart 4.6.2 and earlier allows attackers to execute arbitrary PHP code via vectors involving a custom page...

CS-Cart administration section file upload vulnerability

CS-Cart is a PHP and MySQL based e-commerce software system developed by CS-Cart team. The system supports third-party software extensions, customized promotional strategies, product filtering definitions, etc. The administration section is one of the management components. A file upload...

CS Cart 4.6.2 Shell Upload

Summary CSC Cart is a PHP based shopping cart software, which is hosted either locally or by the company csc-cart company. It has a vulnerability in the administration section, which allows full remote code execution on the server. This has been allcoated CVE-2017-15673 Vendor of Product...

Cross site scripting

Cross-site scripting vulnerability in CS-Cart Japanese Edition v4.3.10 and earlier excluding v2 and v3, CS-Cart Multivendor Japanese Edition v4.3.10 and earlier excluding v2 and v3 allows an attacker to inject arbitrary web script or HTML via unspecified vectors...

CVE-2017-10886

Cross-site scripting vulnerability in CS-Cart Japanese Edition v4.3.10 and earlier excluding v2 and v3, CS-Cart Multivendor Japanese Edition v4.3.10 and earlier excluding v2 and v3 allows an attacker to inject arbitrary web script or HTML via unspecified vectors...

CVE-2017-10886

CS-Cart Japanese Edition (and Multivendor Japanese Edition) is affected by CVE-2017-10886. A cross-site scripting vulnerability exists in CS-Cart Japanese Edition versions 4.3.10 and earlier (excluding v2/v3), enabling an attacker to inject arbitrary web script or HTML via unspecified vectors. Th...

CVE-2017-10886

Cross-site scripting vulnerability in CS-Cart Japanese Edition v4.3.10 and earlier excluding v2 and v3, CS-Cart Multivendor Japanese Edition v4.3.10 and earlier excluding v2 and v3 allows an attacker to inject arbitrary web script or HTML via unspecified vectors...

CVE-2017-10886: Improper Neutralization of Input During Web Page Generation

Cross-site scripting vulnerability in CS-Cart Japanese Edition v4.3.10 and earlier excluding v2 and v3, CS-Cart Multivendor Japanese Edition v4.3.10 and earlier excluding v2 and v3 allows an attacker to inject arbitrary web script or HTML via unspecified vectors...

CS-Cart Japanese Edition vulnerable to cross-site scripting

Overview CS-Cart is a system for creating online shopping websites. CS-Cart Japanese Edition contains a cross-site scripting vulnerabulity CWE-79. Satoshi Ogawa of Mitsui Bussan Secure Directions, Inc. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information...