PT-2011-5166 · Xt:Commerce · Xt:Commerce

Published 2011-12-25 · Updated 2024-03-19 · CVE-2011-5011

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions xt:Commerce versions 3.0.4 SP2.1 and earlier

Description The issue allows remote attackers to hijack the authentication of admins for specific requests. This can be achieved through cross-site request forgery (CSRF) vulnerabilities. The vulnerabilities are exploited by manipulating the cID parameter in two scenarios:

1. Setting a new user to admin via the statusconfirm action in admin/customers.php.
2. Granting permissions to users via the save action in admin/accounting.php.

Recommendations For xt:Commerce versions 3.0.4 SP2.1 and earlier, consider disabling the statusconfirm and save actions in admin/customers.php and admin/accounting.php respectively until a patch is available. Restrict access to these modules to minimize the risk of exploitation. Avoid using the cID parameter in the affected API endpoints until the issue is resolved.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2011-5011

Affected Products

Xt:Commerce

References · 7

• http://secunia.com/advisories/47032 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2011-5011 · Security Note
• http://dishix.blogspot.com/p/xtcommerce-v304-sp21-cross-site-request_29.html · Note
• http://osvdb.org/77498 · Note
• http://dishix.blogspot.com/2011/11/exploiting-xtcommerce-v304-sp21-cross.html · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-5011 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/71642 · Note