S-Cart Stored Cross-Site Scripting Vulnerability in Admin Log Viewer

A stored cross-site scripting vulnerability has been identified in the Admin Log Viewer of S-Cart versions through 10.0.3. This vulnerability allows remote authenticated attackers to inject arbitrary web scripts or HTML by crafting a malicious User-Agent header. The injected script is executed in the browser of an administrator viewing the security log page, potentially leading to session hijacking or other malicious actions.

Impact

Exploitation of this vulnerability allows for stored cross-site scripting, where injected scripts are executed in the context of the user viewing the log.

Remediation

Users can upgrade to S-Cart version 10.0.4 or later, where this vulnerability has been addressed.