PT-2025-23491 · Unknown · Ce Phoenix

Adityaax · Published 2025-06-02 · Updated 2025-06-02 · CVE-2025-47272

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions CE Phoenix eCommerce platform versions 1.0.9.7 through 1.1.0.3

Description The issue allows logged-in users to delete their accounts without requiring password re-authentication. An attacker with temporary access to an authenticated session could permanently delete the user’s account without knowledge of the password. This bypass of re-authentication puts users at risk of account loss and data disruption.

Recommendations For versions 1.0.9.7 through 1.1.0.3, update to version 1.1.0.3 to resolve the issue. As a temporary workaround, consider restricting access to account deletion functionality until the patch is applied.

Exploit

Fix

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

BDU:2025-10515

CVE-2025-47272

GHSA-62QJ-PVWM-H8CV

Affected Products

Ce Phoenix

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/47xxx/CVE-2025-47272.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-47272 · Security Note
• https://osv.dev/vulnerability/CVE-2025-47272 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-10515 · Security Note
• https://github.com/CE-PhoenixCart/PhoenixCart/commit/e87162b15d31c4126acfc1aad6108e5b9955bb76 · Note
• https://github.com/CE-PhoenixCart/PhoenixCart/security/advisories/GHSA-62qj-pvwm-h8cv · Note
• https://twitter.com/CVEnew/status/1929496854300909832 · Twitter Post
• https://t.me/cvetracker/25160 · Telegram Post