PT-2009-6299 · Opensolution · Quick.Cart

Publicado 2009-12-01 · Atualizado 2017-08-17 · CVE-2009-4120

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Quick.Cart version 3.4

Description The issue allows remote attackers to hijack the authentication of the administrator for requests. This can be done via an orders-delete action to "admin.php" for deleting orders. Additionally, it may be possible to delete products or pages via unspecified vectors.

Recommendations For Quick.Cart version 3.4, consider restricting access to the "admin.php" endpoint to minimize the risk of exploitation. As a temporary workaround, avoid using the orders-delete action until a patch is available. Restrict access to delete products and pages functionality to authorized personnel only.

Exploit

Correção

CSRF

Enumeração de Fraquezas

CWE-352

Identificadores relacionados

CVE-2009-4120

Produtos afetados

Quick.Cart

Referências · 6

• 🔥 https://exploit-db.com/exploits/33375 · Exploit
• 🔥 http://securityfocus.com/bid/37115 · Exploit
• 🔥 http://archives.neohapsis.com/archives/fulldisclosure/2009-11/0260.html · Exploit
• 🔥 https://exploit-db.com/exploits/10224 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2009-4120 · Nota de Segurança
• https://exchange.xforce.ibmcloud.com/vulnerabilities/54413 · Nota