CVE-2021-47856
Non-Persistent XSS in Easy Cart Search Enables Session Hijack
Publication date: 2026-02-01
Last updated on: 2026-02-01
Assigner: VulnCheck
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| netart_media | easy_cart | 2021 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2021-47856 is a non-persistent (reflected) cross-site scripting (XSS) vulnerability in the Easy Cart Shopping Cart PHP script (2021 version). It affects the `keyword_search` parameter in the search module, which processes POST requests. Remote attackers can inject malicious JavaScript code via this parameter without authentication. When a victim submits a search, the injected script executes on the search results page, allowing attackers to hijack user sessions, perform phishing attacks, redirect users to malicious sites, or manipulate application content. [1]
How can this vulnerability impact me? :
This vulnerability can impact you by allowing remote attackers to inject and execute malicious scripts in users' browsers when they use the search function. This can lead to session hijacking, where attackers take over user sessions, phishing attacks to steal sensitive information, redirects to malicious websites, and unauthorized manipulation of the application content. These impacts can compromise user security and trust in the application. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by sending crafted POST requests to the Easy Cart Shopping Cart's search endpoint (index.php) targeting the `keyword_search` parameter with malicious script payloads. For example, you can use curl to send a POST request with a payload that includes script tags or special characters to see if the response reflects the injected code. A sample command might be: curl -X POST -d "page=products&proceed_search=1&keyword_search=<script>alert(1)</script>" http://your-target-site/index.php. If the response page reflects the injected script without proper sanitization, the vulnerability is present. [1]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include applying any available patches or updates from the vendor to fix the reflected XSS vulnerability. If patches are not available, implement input validation and output encoding on the `keyword_search` parameter to prevent script injection. Additionally, consider using Web Application Firewalls (WAF) to block malicious POST requests containing suspicious script payloads targeting the search functionality. Educate users to avoid clicking on suspicious links that exploit this vulnerability until it is resolved. [1]
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability allows remote attackers to inject malicious scripts that can compromise user sessions and manipulate application content. Such session hijacking and unauthorized manipulation of data could lead to breaches of user privacy and data integrity, potentially impacting compliance with standards like GDPR and HIPAA that require protection of personal data and secure user sessions. However, specific impacts on compliance are not detailed in the provided resources. [1]