CVE-2024-4348

Deeper analysis

A cross-site scripting vulnerability exists in osCommerce version 4 within the /catalog/all-products page. The flaw, tracked as CVE-2024-4348 and assigned CWE-79, arises from insufficient sanitization of the cat parameter, allowing an attacker to inject arbitrary script into responses served to other users. It received a CVSS 3.1 score of 4.3, reflecting network attack vector, low complexity, and the requirement for user interaction.

An unauthenticated remote attacker can exploit the issue by crafting a malicious link or request that includes script content in the cat argument. Successful exploitation results in execution of attacker-controlled JavaScript in the victim's browser, enabling actions such as theft of session tokens or defacement of page content, though confidentiality and availability are unaffected.

Public references consist solely of VulDB entries that note the vendor was contacted prior to disclosure but provided no response, with no official patch or mitigation guidance published. The EPSS score rose from a low baseline to a peak of 0.2323 before settling at 0.1578, indicating increased exploitation interest after the vulnerability became public.