Executive brief
CS-Cart, a popular e-commerce platform, contains a security flaw in its vendor login system. The system fails to limit the number of times a user can try to log in, allowing attackers to repeatedly guess passwords until they gain access. If successful, an attacker could take over vendor accounts, potentially leading to the theft of customer data, financial loss, or disruption of store operations.
Technical details
A lack of rate limiting and anti-automation controls was identified in the vendor login functionality (vendor.php) of CS-Cart version 4.18.3. The application does not implement CAPTCHA verification, account lockouts, or request throttling after failed authentication attempts. This allows a remote, unauthenticated attacker to perform automated brute-force or credential-stuffing attacks. Successful exploitation can lead to full account takeover of vendor profiles. Mitigation involves implementing reCAPTCHA and account lockout thresholds.
Affected products
- CS-Cart CS-Cart 4.18.3
Timeline
- 2025-07-31: advisory: NVD published the CVE record