What is GHSA-38f9-4vhq-9cr8?

GHSA-38f9-4vhq-9cr8 is a security advisory published by GitHub Security Advisories with High severity. Zen Cart vulnerable to authenticated remote code execution

Which CVE IDs does GHSA-38f9-4vhq-9cr8 cover?

GHSA-38f9-4vhq-9cr8 covers the following CVE IDs: CVE-2021-3291. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-38f9-4vhq-9cr8?

GHSA-38f9-4vhq-9cr8 has a CVSS v3 base score of 7.2, published by GitHub Security Advisories.

Which products are affected by GHSA-38f9-4vhq-9cr8?

GHSA-38f9-4vhq-9cr8 affects 1 product, including: composer/zencart/zencart:\u003c= 1.5.7b.

GHSA-38f9-4vhq-9cr8HighCVSS 7.2

Zen Cart vulnerable to authenticated remote code execution

Vendor

GitHub Security Advisories

Published

May 24, 2022

Last Modified

July 7, 2023

🔗 CVE IDs covered (1)

CVE-2021-3291 →

📋 Description

Zen Cart 1.5.7b allows admins to execute arbitrary OS commands by inspecting an HTML radio input element (within the modules edit page) and inserting a command.

🎯 Affected products1

composer/zencart/zencart:<= 1.5.7b

🔗 References (5)

https://nvd.nist.gov/vuln/detail/CVE-2021-3291
https://github.com/MucahitSaratar/zencart_auth_rce_poc
http://packetstormsecurity.com/files/161613/Zen-Cart-1.5.7b-Remote-Code-Execution.html
https://github.com/zencart/zencart/commit/7447627f7148b11c614f89dab4a09d3f102b58af
https://github.com/advisories/GHSA-38f9-4vhq-9cr8