Listen to this Post
How the CVE Works
The vulnerability exists in the Admin Log Viewer feature of S-Cart versions up to and including 10.0.3. The application fails to properly sanitize the User-Agent string before storing it in the security log. A remote attacker with authenticated access can send a request containing a malicious script within the User-Agent header. This malicious input is then stored in the application’s database. When an administrator subsequently accesses the security log page to review activity, the application retrieves the malicious script from the database and renders it unsanitized within the page. The script executes in the context of the administrator’s session, potentially allowing the attacker to hijack the session, perform actions on behalf of the administrator, or deface the admin panel.
Platform: S-Cart
Version: <=10.0.3
Vulnerability: Stored XSS
Severity: Low
date: 2025-09-23
Prediction: Patch by 2025-10-15
What Undercode Say:
Analytics
grep -r "User-Agent" scart/core/ --include=".php"
cat scart/app/Models/AdminLog.php
curl -H "User-Agent: <script>alert('XSS')</script>" http://target-store/
How Exploit:
1. Attacker logs into a low-privilege account.
2. Attacker sends HTTP request with malicious User-Agent.
3. Script saves in admin log.
4. Admin views log, triggering script execution.
Protection from this CVE
Implement output encoding on log display.
Sanitize User-Agent input before storage.
Update to patched version when released.
Impact:
Admin session hijacking.
Unauthorized admin access.
Data manipulation.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
