Cross-Site Scripting Vulnerability in Zen Cart by Zen Cart
CVE-2017-10667

6.1MEDIUM

Key Information:

Vendor

Zen-cart

Status
Zen Cart
Vendor
CVE Published:
29 June 2017

What is CVE-2017-10667?

A cross-site scripting (XSS) vulnerability in the index.php file of Zen Cart version 1.6.0 allows attackers to inject malicious scripts via the products_id parameter. This exploitation can potentially compromise user data and integrity of web applications, making it essential for users and administrators to apply security patches and updates to mitigate the risk.

References

https://github.com/zencart/zencart/issues/1443
x_refsource_MISC
https://github.com/zhonghaozhao/zencart/issues/1
x_refsource_MISC

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability Reserved

  • Vulnerability published

.