A stored cross-site scripting vulnerability in SPA-CART CMS 1.9.0.3 allows authenticated administrators to execute malicious scripts, posing a significant risk of administrative account compromise.

The application is susceptible to stored cross-site scripting (CWE-79) within the product description parameter. An attacker can inject malicious JavaScript payloads through the descr parameter in the product edit form, which subsequently executes within the browsers of administrative users.

The ability to execute arbitrary scripts in the context of an administrator's browser can lead to full administrative account takeover, unauthorized data modification, and potential session hijacking. Given the CVSS score of 7.5, this vulnerability represents a high risk to the confidentiality and integrity of the CMS environment and the data managed therein.

Immediate Action: Since a specific patch version is not currently identified, administrators should restrict access to the product edit form and sanitize all input fields manually until an official vendor update is released.

Proactive Monitoring: Security teams should monitor web server access logs for suspicious input patterns within the descr parameter and review administrative user activity for signs of unauthorized script execution.

Compensating Controls: Deploy a Web Application Firewall (WAF) configured with strict XSS filtering rules to inspect and block malicious JavaScript payloads submitted via the product description field.

Public Exploit Available: Yes, a published proof-of-concept exists, as documented in the ExploitDB entry 51919.

This vulnerability presents a high risk due to the potential for administrative privilege escalation through XSS. Organizations utilizing SPA-CART CMS 1.9.0.3 must prioritize the implementation of compensating controls, such as WAF rules, and maintain close communication with the vendor for the release of an official security update.