Executive brief
ZeusCart, an open-source e-commerce shopping cart platform, contains a security flaw that allows attackers to perform unauthorized administrative actions. By tricking an authenticated administrator into visiting a malicious website, an attacker can silently deactivate customer accounts. This can lead to service disruptions for customers and operational headaches for store owners as legitimate users are locked out of their accounts.
Technical details
A Cross-Site Request Forgery (CSRF) vulnerability exists in ZeusCart 4.0 due to a lack of unique token validation on administrative forms. The vulnerability specifically affects the 'regstatus' endpoint in the admin interface. An attacker can craft a malicious request (e.g., using a hidden image tag or auto-submitting form) targeting the URL 'admin/?do=regstatus&action=deny&id=[ID]'. If an authenticated administrator views a page containing this malicious payload, the application will process the request as if it were intentional, resulting in the deactivation of the specified customer account. This attack requires the victim to have an active administrative session but does not require the attacker to have any prior credentials.
Affected products
- ZeusCart ZeusCart 4.0
Timeline
- 2018-12-20: disclosed: Initial discovery and exploit publication by mqt
- 2026-06-01: advisory: CVE published and added to NVD dataset