CVE-2025-57407

A stored cross-site scripting (XSS) vulnerability in the Admin Log Viewer of S-Cart <=10.0.3 allows a remote authenticated attacker to inject arbitrary web script or HTML via a crafted User-Agent header. The script is executed in an administrator's browser when they view the security log page, which could lead to session hijacking or other malicious actions.

CVSS v3 5.4 MEDIUM

5.4^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.3 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://github.com/gp247net/core/releases/tag/1.1.24	Release Notes
https://github.com/s-cart/core/blob/7c9aa42761be5fd0131c61dbe2b5323beb96d5dd/src/Admin/Controllers/AdminLogController.php	Product

Configurations

Configuration 1 (hide)

cpe:2.3:a:gp247:gp247:*:*:*:*:*:*:*:*

History

05 Nov 2026, 23:10

Type	Values Removed	Values Added
Summary		(es) Una vulnerabilidad de cross-site scripting (XSS) almacenada en el Visor de Registros de Administración de S-Cart menor o igual que 10.0.3 permite a un atacante remoto autenticado inyectar script web o HTML arbitrario a través de un encabezado User-Agent manipulado. El script se ejecuta en el navegador de un administrador cuando ven la página de registro de seguridad, lo que podría conducir al secuestro de sesión u otras acciones maliciosas.

Information

Published : 2025-09-23 16:15

Updated : 2026-11-05 23:10

NVD link : CVE-2025-57407

Mitre link : CVE-2025-57407

CVE.ORG link : CVE-2025-57407

JSON object : View

Products Affected

gp247

gp247

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2025-57407", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-57407", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-09-24T14:09:24.650553Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.3}]}, "affected": [{"source": "cve@mitre.org", "affectedData": [{"vendor": "n/a", "product": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}]}], "published": "2025-09-23T16:15:32.567", "references": [{"url": "https://github.com/gp247net/core/releases/tag/1.1.24", "tags": ["Release Notes"], "source": "cve@mitre.org"}, {"url": "https://github.com/s-cart/core/blob/7c9aa42761be5fd0131c61dbe2b5323beb96d5dd/src/Admin/Controllers/AdminLogController.php", "tags": ["Product"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "A stored cross-site scripting (XSS) vulnerability in the Admin Log Viewer of S-Cart <=10.0.3 allows a remote authenticated attacker to inject arbitrary web script or HTML via a crafted User-Agent header. The script is executed in an administrator's browser when they view the security log page, which could lead to session hijacking or other malicious actions."}, {"lang": "es", "value": "Una vulnerabilidad de cross-site scripting (XSS) almacenada en el Visor de Registros de Administraci\u00f3n de S-Cart menor o igual que 10.0.3 permite a un atacante remoto autenticado inyectar script web o HTML arbitrario a trav\u00e9s de un encabezado User-Agent manipulado. El script se ejecuta en el navegador de un administrador cuando ven la p\u00e1gina de registro de seguridad, lo que podr\u00eda conducir al secuestro de sesi\u00f3n u otras acciones maliciosas."}], "lastModified": "2026-11-05T23:10:00.150", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:gp247:gp247:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E1D9675F-FB4C-432C-BC05-C7F119D2E42A", "versionEndExcluding": "1.1.24"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}