CVE-2023-4547: SPA-Cart eCommerce CMS search filter parameters cross-site scripting

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

high priorityPublic exploit code exists and EPSS is very high (0.61308, 99.1st percentile), though the CVSS score is only medium and KEV does not list it.

What it is

SPA-Cart eCommerce CMS 1.9.0.3 reflects the filter[brandid] and filter[price] arguments of the /search endpoint without adequate output encoding, allowing reflected cross-site scripting. The flaw is rated medium (CVSS 6.1) and matters because the search page is a routine, unauthenticated entry point that can be weaponized against shoppers or administrators.

Impact

An attacker can execute arbitrary script in the victim's browser in the context of the affected site, enabling session theft, credential phishing or page manipulation. The CVSS scope change (S:C) indicates the injected script can affect resources beyond the vulnerable component.

Attack surface

Reached remotely over HTTP through the /search endpoint by supplying crafted filter[brandid] or filter[price] values; no authentication is required, but the CVSS vector (UI:R) indicates a victim must be induced to open a crafted link or page.

Exploitation

A public exploit is referenced on Packet Storm, and EPSS is 0.61308 (99.1st percentile), indicating high predicted exploitation activity; the CVE is not listed in CISA KEV, so no confirmed in-the-wild exploitation is recorded.

What to do

• Apply the vendor fix for SPA-Cart eCommerce CMS 1.9.0.3 or later if available; if no patch exists, treat the product as unsupported and plan migration.
• Encode or sanitize all output of the filter[brandid] and filter[price] parameters on the /search endpoint, and validate them against an allowlist of expected values.
• Deploy a WAF rule blocking script payloads in filter[] parameters on /search as a temporary compensating control.
• Set session cookies with HttpOnly and SameSite attributes and enforce a strict Content-Security-Policy to reduce script execution impact.

Detection

• Search web and proxy logs for requests to /search containing filter[brandid] or filter[price] values with script tags, event handlers or encoded angle brackets.
• Alert on WAF or IDS signatures matching XSS patterns in query strings targeting the /search path.
• Monitor for anomalous outbound requests or new sessions originating from users who recently hit crafted /search URLs.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.