CVE-2024-58304 is a stored cross-site scripting vulnerability (CWE-79) in SPA-CART CMS 1.9.0.3. The issue arises from improper neutralization of input during web page generation, specifically in the product description ('descr') parameter. Authenticated administrators can submit JavaScript payloads through the product edit form, leading to arbitrary code execution in the context of administrative users' browsers. This vulnerability requires authentication and user interaction (UI:P), and the attack vector is network-based (AV:N).

Successful exploitation allows an attacker with authenticated administrator access to inject and execute arbitrary JavaScript code within the administrative interface. This can lead to session hijacking, unauthorized actions performed by administrators, or other malicious activities within the CMS environment. The impact is limited to authenticated administrators and does not allow unauthenticated remote exploitation.

No official patch or fix is currently available for this vulnerability. Users should monitor the vendor's advisory for updates. In the meantime, restrict administrator access to trusted personnel only and consider additional input validation or sanitization controls on the 'descr' parameter if possible. Avoid using the vulnerable version 1.9.0.3 in production environments until a fix is released.