PT-2025-31558 · Cs Cart · Cs-Cart

Hackerwahab · Publicado 2025-07-31 · Atualizado 2025-07-31 · CVE-2025-50848

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions CS Cart version 4.18.3

Description A file upload vulnerability exists that allows attackers to execute arbitrary code. The software allows unrestricted upload of HTML files, which are rendered directly in the browser when accessed. This enables an attacker to upload a crafted HTML file containing malicious content, such as a fake login form for credential harvesting or scripts for Cross-Site Scripting (XSS) attacks. Serving content from a trusted domain increases the likelihood of successful phishing or script execution against other users.

Recommendations Restrict file uploads to only necessary file types and thoroughly validate all uploaded files to prevent the execution of malicious code.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2025-50848

Produtos afetados

Cs-Cart

Referências · 8

• 🔥 https://github.com/hackerwahab/CS-Cart-Vulns/blob/main/CVE-2025-50848.md · Exploit
• http://cs.com · Nota
• https://osv.dev/vulnerability/CVE-2025-50848 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2025-50848 · Nota de Segurança
• https://twitter.com/CVEnew/status/1950956394997514717 · Publicação no Twitter
• https://t.me/cveNotify/130416 · Publicação no Telegram
• https://t.me/CVEtracker/28871 · Publicação no Telegram
• https://twitter.com/VulmonFeeds/status/1950986311059316815 · Publicação no Twitter