Vulnerability Description
Zen Cart 1.5.7b allows admins to execute arbitrary OS commands by inspecting an HTML radio input element (within the modules edit page) and inserting a command.
CVSS Score
7.2
HIGH
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Zen-Cart | Zen Cart | 1.5.7b |
Related Weaknesses (CWE)
References
- http://packetstormsecurity.com/files/161613/Zen-Cart-1.5.7b-Remote-Code-ExecutioExploitThird Party AdvisoryVDB Entry
- https://github.com/MucahitSaratar/zencart_auth_rce_pocExploitThird Party Advisory
- http://packetstormsecurity.com/files/161613/Zen-Cart-1.5.7b-Remote-Code-ExecutioExploitThird Party AdvisoryVDB Entry
- https://github.com/MucahitSaratar/zencart_auth_rce_pocExploitThird Party Advisory
FAQ
What is CVE-2021-3291?
CVE-2021-3291 is a vulnerability with a CVSS score of 7.2 (HIGH). Zen Cart 1.5.7b allows admins to execute arbitrary OS commands by inspecting an HTML radio input element (within the modules edit page) and inserting a command.
How severe is CVE-2021-3291?
CVE-2021-3291 has been rated HIGH with a CVSS base score of 7.2/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2021-3291?
Check the references section above for vendor advisories and patch information. Affected products include: Zen-Cart Zen Cart.