MEDIUM5.4

GHSA-7pfc-cx3m-v22x

SCart is vulnerable to cross-site scripting (XSS)

Quick fix

GHSA-7pfc-cx3m-v22x — s-cart/core: upgrade to the fixed version with the command below.

composer require s-cart/core:^6.9

Details

SCart e-commerce is a free open source for businesses, built on the Laravel framework. The package s-cart/s-cart before 6.9 and the package s-cart/core before 6.9 are vulnerable to cross-site Scripting (XSS) which can lead to cookie stealing of any victim that visits the affected URL. An attacker can gain unauthorized access to that user's account through the stolen cookie.

Are you affected?

Enter the version of the package you're using.

Affected packages

Packagist/s-cart/core

Introduced in: 0Fixed in: 6.9

Fixcomposer require s-cart/core:^6.9

Packagist/s-cart/s-cart

Introduced in: 0Fixed in: 6.9

Fixcomposer require s-cart/s-cart:^6.9

References

https://nvd.nist.gov/vuln/detail/CVE-2022-21149[ADVISORY]
https://github.com/s-cart/core[PACKAGE]
https://snyk.io/vuln/SNYK-PHP-SCARTCORE-2389036[WEB]
https://snyk.io/vuln/SNYK-PHP-SCARTSCART-2389035[WEB]