PT-2020-17041 · Opencart · Opencart Cms

Published 2020-12-11 · Updated 2022-05-24 · CVE-2020-28838

Positive Technologies (AI Summary)

CVSS v2.0

3.5

Low

Base vector

AV:N/AC:M/Au:S/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Opencart CMS version 3.0.3.6

Description The issue allows an attacker to perform a Cross Site Request Forgery (CSRF) attack in the CART option, enabling them to add cart items via the 'Add to cart' function.

Recommendations For Opencart CMS version 3.0.3.6, consider implementing proper CSRF token validation to prevent unauthorized requests, and restrict access to the 'Add to cart' function until a fix is available.

Exploit

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2020-28838

GHSA-3J6M-M5V5-9785

Affected Products

Opencart Cms

References · 11

• 🔥 https://exploit-db.com/exploits/49228 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2020-28838 · Security Note
• https://osv.dev/vulnerability/CVE-2020-28838 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-3j6m-m5v5-9785 · Vendor Advisory
• https://github.com/opencart/opencart · Note
• https://t.me/cibsecurity/20314 · Telegram Post
• https://opencart.com · Note
• https://t.me/cibsecurity/20276 · Telegram Post
• https://t.me/cibsecurity/20334 · Telegram Post
• https://t.me/cibsecurity/20256 · Telegram Post
• https://t.me/cibsecurity/20295 · Telegram Post