CVE-2011-0503 Cross-site request forgery (CSRF) vulnerability in VaM Shop 1.6, 1.6.1, and probably earlier versions allows remote attackers to hijack the authentication of administrators for requests that (1) chang...
MediumCVSS 6.8
EPSS 2.1%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
Cross-site request forgery (CSRF) vulnerability in VaM Shop 1.6, 1.6.1, and probably earlier versions allows remote attackers to hijack the authentication of administrators for requests that (1) change user status via admin/customers.php or (2) change user permissions via admin/accounting.php. NOTE: some of these details are obtained from third party information.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| vamsoft vam shop | <= 1.6.1 | No fix listed |
| vamsoft vam shop | = 1.6 | No fix listed |
References
- 70431 vdb-entry
- 42869 third-party-advisory vendor-advisory
- 15968 exploit
- www.htbridge.ch exploit
- 20110111 XSRF (CSRF) in VaM Shop mailing-list