## https://sploitus.com/exploit?id=SRC-2021-0002
**Vulnerability Details:**
This vulnerability allows remote attackers to execute arbitrary code on affected installations of CSCart. Authentication is required to exploit this vulnerability with the Files privilege.
The specific flaw exists within the templates.manage dispatch method. The issue results from the lack of sandboxing of user-supplied Smarty template syntax. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of the web server.
**Affected Vendors:**
CSCart
**Affected Products:**
CSCart Multivendor
**Vendor Response:**
CSCart has not issued an update to correct this vulnerability.
**Proof of Concept:**
* https://github.com/sourceincite/CVE-2021-26121