medium6.8Public exploit code
CVE-2009-4120
Multiple cross-site request forgery (CSRF) vulnerabilities in Quick.Cart 3.4 allow remote attackers to hijack the authentication of the administrator for reque…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Quick.Cart 3.4 / Quick.CMS 2.4 - Delete Function Cross-Site Request Forgery2009-11-24 · webapps · php · Verified
- Quick.Cart 3.4 / Quick.CMS 2.4 - Cross-Site Request Forgery2009-11-24 · webapps · php · Verified
Impact
Multiple cross-site request forgery (CSRF) vulnerabilities in Quick.Cart 3.4 allow remote attackers to hijack the authentication of the administrator for requests that (1) delete orders via an orders-delete action to admin.php, and possibly (2) delete products or (3) delete pages via unspecified vectors.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Opensolution | Quick.Cart | Version 3.4 |
Weakness classification
References
- NVD record
- CVE.org record
- http://archives.neohapsis.com/archives/fulldisclosure/2009-11/0260.html
- http://www.securityfocus.com/bid/37115
- https://exchange.xforce.ibmcloud.com/vulnerabilities/54413
- http://archives.neohapsis.com/archives/fulldisclosure/2009-11/0260.html
- http://www.securityfocus.com/bid/37115
- https://exchange.xforce.ibmcloud.com/vulnerabilities/54413