PT-2021-12496 · Zen Cart · Zen Cart

Gerbert Roitburd + 1 · Published 2021-03-19 · Updated 2022-05-24 · CVE-2020-6578

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: Zen Cart version 1.5.6d

Description: The issue allows reflected XSS via the main page parameter to files such as includes/templates/template default/common/tpl main page.php or includes/templates/responsive classic/common/tpl main page.php.

Recommendations: For Zen Cart version 1.5.6d, as a temporary workaround, consider restricting access to the main page parameter in the affected files until a patch is available.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2020-6578

GHSA-WXXX-2X6V-979F

Affected Products

Zen Cart

References · 10

• 🔥 https://herolab.usd.de/security-advisories/usd-2019-0069 · Exploit
• https://osv.dev/vulnerability/GHSA-wxxx-2x6v-979f · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-6578 · Security Note
• https://osv.dev/vulnerability/CVE-2020-6578 · Vendor Advisory
• https://github.com/zencart/zencart/commit/aa11e1e06c11b8a2940299a4bec0ac3dd95a7895 · Note
• https://herolab.usd.de/security-advisories · Note
• https://t.me/cvenotify/11562 · Telegram Post
• https://t.me/cvenotify/11586 · Telegram Post
• https://t.me/cvenotify/11916 · Telegram Post
• https://t.me/cibsecurity/25166 · Telegram Post