Cross-Site Request Forgery Vulnerabilities in Shopizer Webshop Software by Shopizer
CVE-2014-4964

Currently unrated

Key Information:

Vendor

Shopizer

Status
Shopizer
Vendor
CVE Published:
15 July 2014

What is CVE-2014-4964?

Multiple cross-site request forgery vulnerabilities in Shopizer prior to version 1.1.5 allow remote attackers to exploit user sessions, potentially hijacking authentication to perform unauthorized actions. These vulnerabilities can lead to modifications in customer settings, changes to customer passwords, alterations in shop configurations, or updates to product details through crafted requests. For instance, attackers could manipulate product pricing or facilitate unauthorized product reviews using specially designed requests to specific action paths within the application.

References

http://www.securityfocus.com/archive/1/532726/100/0/threaded
mailing-listx_refsource_BUGTRAQ
http://seclists.org/fulldisclosure/2014/Jul/38
mailing-listx_refsource_FULLDISC

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.