Xt-commerce : Security Vulnerabilities, CVEs, Published In 2011
Multiple cross-site request forgery (CSRF) vulnerabilities in xt:Commerce 3.0.4 SP2.1 and possibly earlier allow remote attackers to hijack the authentication of Admins for requests that (1) set a New user to Admin via the cID parameter to a statusconfirm action in admin/customers.php and (2) grant permissions to users via the cID parameter to a save action in admin/accounting.php.
Max CVSS
6.8
EPSS Score
0.25%
Published
2011-12-25
Updated
2024-03-19
1 vulnerabilities found