PT-2009-6299 · Opensolution · Quick.Cart

Published 2009-12-01 · Updated 2017-08-17 · CVE-2009-4120

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Quick.Cart version 3.4

Description The issue allows remote attackers to hijack the authentication of the administrator for requests. This can be done via an orders-delete action to "admin.php" for deleting orders. Additionally, it may be possible to delete products or pages via unspecified vectors.

Recommendations For Quick.Cart version 3.4, consider restricting access to the "admin.php" endpoint to minimize the risk of exploitation. As a temporary workaround, avoid using the orders-delete action until a patch is available. Restrict access to delete products and pages functionality to authorized personnel only.

Exploit

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2009-4120

Affected Products

Quick.Cart

References · 6

• 🔥 https://exploit-db.com/exploits/33375 · Exploit
• 🔥 http://securityfocus.com/bid/37115 · Exploit
• 🔥 http://archives.neohapsis.com/archives/fulldisclosure/2009-11/0260.html · Exploit
• 🔥 https://exploit-db.com/exploits/10224 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2009-4120 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/54413 · Note