PT-2025-50757 · Unknown · Spa-Cartcms

Eren Sen + 1 · Published 2025-12-11 · Updated 2025-12-12 · CVE-2024-58304

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions SPA-CART CMS version 1.9.0.3

Description The software contains a stored cross-site scripting issue in the product description parameter. Authenticated administrators can inject malicious scripts. Attackers can submit JavaScript payloads through the descr parameter in the product edit form, leading to arbitrary code execution in administrative users' browsers.

Recommendations Administrators should sanitize the descr parameter in the product edit form to prevent script injection.

Exploit

Fix

XSS

SQL injection

Weakness Enumeration

CWE-79

CWE-89

Related Identifiers

CVE-2024-58304

Affected Products

Spa-Cartcms

References · 9

• 🔥 https://exploit-db.com/exploits/51919 · Exploit
• 🔥 https://exploit-db.com/exploits/51811 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-58304 · Security Note
• https://github.com/PuneethReddyHC/online-shopping-system-advanced · Note
• https://spa-cart.com · Note
• https://vulncheck.com/advisories/online-shopping-system-advanced-sql-injection-via-payment-success-parameter · Note
• https://twitter.com/VulmonFeeds/status/1999304099800531417 · Twitter Post
• https://t.me/CVEtracker/39535 · Telegram Post
• https://vulncheck.com/advisories/spa-cart-cms-stored-cross-site-scripting-via-product-description · Note