# CVE-2025-50847: CS-Cart CSRF in product comparison list

Source: https://junglewise.ai/threats/cve-2025-50847-cs-cart-csrf-in-product-comparison-list  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-07-31. Updated: 2026-07-05  
License: CC BY 4.0 with a link back

CVE-2025-50847 · Severity: medium · CVSS 6.5 · Published 2025-07-31

CS-Cart is a popular e-commerce platform used by businesses to manage online stores. A security flaw allows an attacker to trick a logged-in user into performing unintended actions, specifically adding items to their product comparison list without their consent. While this specific action has low direct impact, it demonstrates a lack of security controls that could potentially be used in more complex social engineering or profiling attacks against customers.

Technologies: [Cs-Cart](https://junglewise.ai/threats/technologies/cs-cart). Vendors: [Cs-Cart](https://junglewise.ai/threats/vendors/cs-cart).

## Quick answers

**Is CVE-2025-50847 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-50847 being exploited in the wild.

**How severe is CVE-2025-50847?** Medium severity, with a CVSS score of 6.5, published 31 July 2025.

**Which products and versions are affected?** Cs-Cart 4.18.3.

**Is there a fix for CVE-2025-50847?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2025-50847 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2025-50847?** Check whether you run Cs-Cart at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A Cross-Site Request Forgery (CSRF) vulnerability exists in CS-Cart version 4.18.3 within the index.php endpoint. The application fails to properly validate CSRF tokens for state-changing requests related to the product comparison functionality. An unauthenticated remote attacker can exploit this by tricking an authenticated user into visiting a malicious webpage or clicking a link, which then executes a crafted HTTP request on the user's behalf. Successful exploitation allows the attacker to manipulate the user's comparison list, which can be used for user profiling or as a component in broader social engineering campaigns. Mitigation involves implementing robust CSRF token validation and applying SameSite cookie attributes.

## Affected products

- CS-Cart CS-Cart 4.18.3

## Timeline

- 2025-07-31: advisory: NVD publication date

## References

- [https://github.com/hackerwahab/CS-Cart-Vulns/blob/main/CVE-2025-50847.md](https://github.com/hackerwahab/CS-Cart-Vulns/blob/main/CVE-2025-50847.md)

## Related threats

- [CS-Cart missing rate limiting in vendor login](https://junglewise.ai/threats/cve-2025-50850-cs-cart-missing-rate-limiting-in-vendor-login)
- [CS-Cart unrestricted HTML file upload in File Manager](https://junglewise.ai/threats/cve-2025-50848-cs-cart-unrestricted-html-file-upload-in-file-manager)
- [CS-Cart IDOR in vendor sticker management](https://junglewise.ai/threats/cve-2025-50849-cs-cart-idor-in-vendor-sticker-management)