CVE-2024-58304 is a stored XSS vulnerability in SPA-CART CMS 1.9.0.3 affecting the product description ('descr') parameter. Authenticated administrators can submit JavaScript payloads that are stored and later executed in the context of administrative users' browsers. This improper neutralization of input during web page generation (CWE-79) can lead to arbitrary code execution within the admin interface. The vulnerability requires authentication and user interaction (UI:P), with network attack vector (AV:N) and low complexity (AC:L).

Successful exploitation allows attackers with administrator access to inject and execute malicious scripts in the browsers of other administrative users. This can lead to session hijacking, unauthorized actions, or theft of sensitive information within the administrative interface. The vulnerability does not allow unauthenticated remote exploitation and has limited impact scope confined to authenticated admin users.

No official patch or vendor advisory is currently available for this vulnerability. Organizations using SPA-CART CMS 1.9.0.3 should restrict administrator access to trusted personnel only and monitor for suspicious activity. Check the vendor's official channels regularly for updates or patches addressing this issue. Until a fix is released, avoid using the vulnerable product description parameter for untrusted input.