XSS Hits Zen Cart Open-Source E-commerce App
Multiple Cross-Site Scripting (XSS) vulnerabilities have been uncovered in the popular online open source shopping cart application, Zen Cart.
XSS, allows the attacker to inject malicious client-side scripts into a website, which are later executed by the victims while browsing the website. There are different cross-site scripting variants, all of which can be used to craft different types of attacks. In this case, malicious XSS injections could result in hackers gaining access to cookies and sensitive information, and could allow site defacement, which can result in further attacks.
According to Trustwave, the vulnerabilities affect Zen Cart 1.5.4 and potentially prior versions—there are both reflective and stored XSS in multiple parameters of number of requests. They were discovered in the admin section of Zen Cart, and one issue in the non-authenticated portion of the application.
