CVE-2021-3291 Zen Cart vulnerable to authenticated remote code execution
Administrators can execute arbitrary OS commands via HTML radio input manipulation in Zen Cart, requiring admin access.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2021-3291?
CVE-2021-3291 is a high-severity command injection vulnerability in n/a, published on 26 Jan 2021. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Zen Cart 1.5.7b allows admins to execute arbitrary OS commands by inspecting an HTML radio input element (within the modules edit page) and inserting a command.
Weakness: CWE-78
Which versions are affected by CVE-2021-3291?
2 open source packages ship an affected version, including zencart/zencart. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
zencart/zencart Packagist | All versions | 1.5.7c |
zencart/zencart Packagist | All versions | 1.5.7c |
Products include Zen-Cart Zen Cart.
How do I fix CVE-2021-3291?
Upgrade zencart/zencart to 1.5.7c or later.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2021-3291 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2021-3291 exists.
Public exploit code: 1 Exploit-DB entry and 1 proofs of concept on GitHub.
Other vulnerabilities in n/a
Sources
Also known as GHSA-38f9-4vhq-9cr8.