Zen Cart vulnerable to authenticated remote code execution
Zen Cart 1.5.7b allows admins to execute arbitrary OS commands by inspecting an HTML radio input element (within the modules edit page) and inserting a command.
01
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2021-3291US | high7.2 | Exploit | ||
Zen Cart 1.5.7b allows admins to execute arbitrary OS commands by inspecting an HTML radio input element (within the modules edit page) and inserting a command. | ||||
02
references
External citations — patches, advisories, analysis.
- http://packetstormsecurity.com/files/161613/Zen-Cart-1.5.7b-Remote-Code-Execution.htmlWEB
- https://github.com/MucahitSaratar/zencart_auth_rce_pocWEB
- https://github.com/zencart/zencartPACKAGE
- https://github.com/zencart/zencart/commit/7447627f7148b11c614f89dab4a09d3f102b58afWEB
- https://nvd.nist.gov/vuln/detail/CVE-2021-3291ADVISORY
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan