CVE-2021-3291

HIGH7.2EPSS 32.6%

Zen Cart vulnerable to authenticated remote code execution

Published: 5/24/2022Modified: 2/16/2024

Description

Zen Cart 1.5.7b allows admins to execute arbitrary OS commands by inspecting an HTML radio input element (within the modules edit page) and inserting a command.

Affected packages (1)

Packagist/zencart/zencartfrom 0, < 1.5.7c

CVSS scores

Source	Version	Severity	Vector
osv	CVSS 3.1	HIGH7.2	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

References (5)

ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2021-3291
PATCHhttps://github.com/zencart/zencart
WEBhttp://packetstormsecurity.com/files/161613/Zen-Cart-1.5.7b-Remote-Code-Execution.html
WEBhttps://github.com/MucahitSaratar/zencart_auth_rce_poc
WEBhttps://github.com/zencart/zencart/commit/7447627f7148b11c614f89dab4a09d3f102b58af