CVEvulnerability
CVE-2011-0503
6.8 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2011-01-20
- Last modified
- 2026-06-16
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 6.8 MEDIUM — AV:N/AC:M/Au:N/C:P/I:P/A:P
- Weaknesses
- CWE-352
Description
Cross-site request forgery (CSRF) vulnerability in VaM Shop 1.6, 1.6.1, and probably earlier versions allows remote attackers to hijack the authentication of administrators for requests that (1) change user status via admin/customers.php or (2) change user permissions via admin/accounting.php. NOTE: some of these details are obtained from third party information.
Affected configurations
• vamsoft vam shop (<= 1.6.1)
• vamsoft vam shop 1.6
Related
Weakness · CWE (1)
- CWE-352 Cross-Site Request Forgery weakness
References
- http://osvdb.org/70431 osvdb.org
- http://secunia.com/advisories/42869 Vendor Advisory
- http://www.exploit-db.com/exploits/15968 www.exploit-db.com
- http://www.htbridge.ch/advisory/xsrf_csrf_in_vam_shop.html Exploit
- http://www.securityfocus.com/archive/1/515613/100/0/threaded www.securityfocus.com
- http://osvdb.org/70431 osvdb.org
- http://secunia.com/advisories/42869 Vendor Advisory
- http://www.exploit-db.com/exploits/15968 www.exploit-db.com
- http://www.htbridge.ch/advisory/xsrf_csrf_in_vam_shop.html Exploit
- http://www.securityfocus.com/archive/1/515613/100/0/threaded www.securityfocus.com