Executive brief
A security vulnerability exists in the ecommerceFlask web application, which is used for managing online store transactions. An attacker can trick a logged-in user into visiting a malicious website that silently triggers a purchase on the store without the user's consent. This can lead to unauthorized financial transactions, depletion of a user's account balance, and the creation of fraudulent orders.
Technical details
A Cross-Site Request Forgery (CSRF) vulnerability exists in the /buy endpoint of the ecommerceFlask application. The root cause is a lack of CSRF protection mechanisms (such as Flask-WTF or CSRFProtect) and missing SameSite cookie attributes in the application configuration. An unauthenticated remote attacker can exploit this by inducing an authenticated user to visit a malicious page that submits a hidden POST request to the /buy endpoint. Successful exploitation allows the attacker to force the victim to purchase products, resulting in unauthorized database updates to user balances and product inventory. As of the advisory date, the project has not responded to the issue report.
Affected products
- imhamzaazam ecommerceFlask up to cb7d9e24c30a99379651b7493b32048126ef402b
Timeline
- 2026-06-07: disclosed: Issue reported on GitHub repository
- 2026-07-06: advisory: CVE published via VulDB/NVD