Moole Vulnerability Database

Find real vulnerabilities before they ship

High

CVE-2021-3291

Zen Cart 1.5.7b allows admins to execute arbitrary OS commands by inspecting an HTML radio input element (within the modules edit page) and inserting a command.

VectorNETWORK

PublishedJan 26, 2021, 18:16

Published Bycve@mitre.org

Base Score

Score7.2

Affected Versions

Package (Ecosystem)IntroducedFixedLimit

zencart/zencart(Packagist)01.5.7cN/A

References

http://packetstormsecurity.com/files/161613/Zen-Cart-1.5.7b-Remote-Code-Execution.html
https://github.com/MucahitSaratar/zencart_auth_rce_poc

Weakness Type

CWE-78

CVSS Metrics

Base Score

7.2

Vector String

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Base SeverityHigh

Version

3.1

Attack Vector (AV)

NETWORK