Description
CubeCart is an ecommerce software solution. Prior to 6.7.5, admin/sources/products.index.inc.php reads the description, description_short, and spec_copy rich-text fields from $GLOBALS['RAW']['POST'] and removes only script elements before the values are stored and rendered through Smarty templates. An administrator with product-editing rights can store event-handler attributes, SVG content, or javascript: URIs that bypass this filter, causing persistent JavaScript execution when a storefront visitor or another administrator views the product content and enabling session exposure or unauthorized browser-context actions. This issue is fixed in version 6.7.5.
CVSS breakdown
CVSS 3.1
Attack Vector
Network
Attack Complexity
Low
Privileges Required
High
User Interaction
Required
Scope
Changed
Confidentiality
Low
Integrity
Low
Availability
None
Affected products
- cubecart / v6< 6.7.5 – < 6.7.5
Exploits & proofs of concept
- exploit-dbCubeCart 6.7.4 - Stored XSSby Mikail KOCADAĞ
References
- VENDOR_ADVISORYhttps://github.com/cubecart/v6/security/advisories/GHSA-43f6-gfcf-wj9c
- PATCHhttps://github.com/cubecart/v6/commit/bd2dcdcc7da55a3731fe288b54cac8bfa3d9142a
- PATCHhttps://github.com/cubecart/v6/commit/f7abe7484691a33abcbc0806fca59d605024a75c
- MISChttps://github.com/cubecart/v6/blob/6.7.5/admin/sources/release_notes/6.7.5.inc.php
- PATCHhttps://github.com/cubecart/v6/releases/tag/6.7.5
Updated 39m ago · 8 sources