CVE-2026-54642
2026-09-17
22h17 +00:00
22h17 +00:00
指定 CVE 通知
随时了解指定 CVE 的变更。
CVE 描述
CubeCart is an ecommerce software solution. Prior to 6.7.5, the reset_id download-counter action and delete_card stored-payment-card action in admin/sources/orders.index.inc.php use state-changing GET requests and are omitted from the protection map in admin/skins/default/csrf.inc.php. A remote attacker can induce an authenticated administrator to issue one of these requests without a validated session token, causing unintended resets of electronic download usage counters or deletion of stored customer payment-card tokens. This issue is fixed in version 6.7.5.
CVE 信息
相关弱点
| 弱点名称 | 来源 | |
|---|---|---|
| Cross-Site Request Forgery The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor. |
