CVE-2021-3291

EPSS 16.8%

No sign of exploitation. has a public proof of concept.

Vexday Risk Score

28Low

SSVC decision (CISA)

Attend

PoC available → attend closely

Exploit maturity

Proof of concept

Popular PoC on GitHub (1 stars) — exploitation code widely available.

CVSS —EPSS 16.8%KEV nãoPoC públicaNuclei —Metasploit —Patch —

Lifecycle

26 Jan 2021Published on NVD

02 Mar 2021Public PoC

Weaponization speed

35 daysto first PoC

Recommendation: Plan a near-term fix — a public PoC already exists.

Zen Cart 1.5.7b allows admins to execute arbitrary OS commands by inspecting an HTML radio input element (within the modules edit page) and inserting a command.

Affected products

n/a · n/a

public PoCs found — 3

githubgithub.com/ImHades101/CVE-2021-3291★ 1 cve_referencepacketstormsecurity.com/files/161613/Zen-Cart-1.5.7b-Remote-Code-Execution.htmlunverified exploitdbwww.exploit-db.com/exploits/49608unverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

References

http://packetstormsecurity.com/files/161613/Zen-Cart-1.5.7b-Remote-Code-Execution.html https://github.com/MucahitSaratar/zencart_auth_rce_poc