CVE-2011-4403 Multiple cross-site request forgery (CSRF) vulnerabilities in Zen Cart 1.3.9h allow remote attackers to hijack the authentication of administrators for requests that (1) delete a product via a delete_...
MediumCVSS 5.8
EPSS 1.7%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
Multiple cross-site request forgery (CSRF) vulnerabilities in Zen Cart 1.3.9h allow remote attackers to hijack the authentication of administrators for requests that (1) delete a product via a delete_product_confirm action to product.php or (2) disable a product via a setflag action to categories.php.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| zen-cart zen cart | = 1.3.9h | No fix listed |
References
- 79137 vdb-entry
- 20120210 Zen-Cart Admin CSRF/XSRF - Delete / Disable Products | UPS-2011-0018 | CVE-2011-4403 exploit mailing-list