PT-2025-50750 · Unknown · Ce Phoenix

Tmrswrr · Published 2025-12-11 · Updated 2025-12-12 · CVE-2024-58296

Positive Technologies (AI Summary)

CVSS v4.0

5.3

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions CE Phoenix version 3.0.1

Description CE Phoenix version 3.0.1 has a stored cross-site scripting issue within the currencies administration panel. An attacker can inject malicious scripts by inserting XSS payloads into the title field. When administrators view the currencies page, the injected JavaScript will execute. The vulnerability allows for the execution of arbitrary JavaScript.

Recommendations Apply a fix to sanitize the title field in the currencies administration panel to prevent the injection of malicious scripts.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-58296

Affected Products

Ce Phoenix

References · 7

• 🔥 https://demos6.softaculous.com/CE_Phoenixx3r6jqi4kl/admin/currencies.php · Exploit
• 🔥 https://exploit-db.com/exploits/52015 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-58296 · Security Note
• https://phoenixcart.org · Note
• https://softaculous.com/apps/ecommerce/CE_Phoenix · Note
• https://twitter.com/VulmonFeeds/status/1999316899386011781 · Twitter Post
• https://vulncheck.com/advisories/ce-phoenix-v-stored-cross-site-scripting-via-currencies-administration · Note