PT-2025-31558 · Cs Cart · Cs-Cart

Hackerwahab · Published 2025-07-31 · Updated 2025-07-31 · CVE-2025-50848

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions CS Cart version 4.18.3

Description A file upload vulnerability exists that allows attackers to execute arbitrary code. The software allows unrestricted upload of HTML files, which are rendered directly in the browser when accessed. This enables an attacker to upload a crafted HTML file containing malicious content, such as a fake login form for credential harvesting or scripts for Cross-Site Scripting (XSS) attacks. Serving content from a trusted domain increases the likelihood of successful phishing or script execution against other users.

Recommendations Restrict file uploads to only necessary file types and thoroughly validate all uploaded files to prevent the execution of malicious code.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-50848

Affected Products

Cs-Cart

References · 8

• 🔥 https://github.com/hackerwahab/CS-Cart-Vulns/blob/main/CVE-2025-50848.md · Exploit
• https://osv.dev/vulnerability/CVE-2025-50848 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-50848 · Security Note
• http://cs.com · Note
• https://twitter.com/CVEnew/status/1950956394997514717 · Twitter Post
• https://t.me/cveNotify/130416 · Telegram Post
• https://t.me/CVEtracker/28871 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1950986311059316815 · Twitter Post