Executive brief
CS-Cart, an e-commerce platform used by businesses to manage online stores, contains a security flaw in its vendor management features. An authenticated user can bypass security checks to modify settings belonging to other vendors, such as enabling or disabling promotional stickers. This could allow a malicious user to interfere with a competitor's branding or store operations, potentially leading to unauthorized changes across the platform.
Technical details
An Insecure Direct Object Reference (IDOR) vulnerability exists in CS-Cart 4.18.3 within the vendor sticker management functionality. The vulnerable endpoint, located at vendor.php?dispatch=ab__stickers.change_vendor_status, fails to perform server-side authorization checks on the company_id and sticker_id parameters. A remote, authenticated attacker with low privileges can manipulate these identifiers in the HTTP request to modify the status of stickers belonging to other companies. This bypasses intended access controls, allowing unauthorized changes to third-party vendor settings. As of the advisory date, users are advised to implement server-side ownership validation for all company-related requests.
Affected products
- CS-Cart CS-Cart 4.18.3
Timeline
- 2025-07-31: advisory: NVD published the CVE record.