PT-2025-3425 · Innoshop · Innoshop

Ilovepepperoni · Published 2025-01-24 · Updated 2026-01-26 · CVE-2024-57277

Positive Technologies (AI Summary)

CVSS v3.1

5.7

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions InnoShop versions 0.3.8 and below

Description The issue concerns Cross Site Scripting (XSS) via SVG file upload. This means an attacker could potentially inject malicious scripts into the system by uploading specially crafted SVG files, leading to the execution of unauthorized code on the client-side.

Recommendations For InnoShop versions 0.3.8 and below, consider disabling SVG file uploads until a patch is available to prevent potential Cross Site Scripting (XSS) attacks. Restrict access to the file upload feature to minimize the risk of exploitation.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-57277

Affected Products

Innoshop

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2024-57277 · Security Note
• https://osv.dev/vulnerability/CVE-2024-57277 · Vendor Advisory
• https://github.com/innocommerce/innoshop/commit/7ccc90d2b549e14460efc4f758b01adbd080e7ff · Note
• https://github.com/innocommerce/innoshop/issues/115 · Note
• https://github.com/yamerooo123/ResearchNBugBountyEncyclopedia/blob/main/Researches/Innocommerce/Findings.md · Note
• https://t.me/cvedetector/16345 · Telegram Post
• https://youtu.be/ved96wsIYlQ · Note
• https://twitter.com/VulmonFeeds/status/1882896784499917185 · Twitter Post
• https://twitter.com/CVEnew/status/1882903046201737299 · Twitter Post
• https://t.me/cveNotify/149865 · Telegram Post