Full Report
Cross-Site Request Forgery (CSRF) vulnerability (CVE-2025-10317) has been found in OpenSolution Quick.Cart software.
Analysis Summary
# Vulnerability: Cross-Site Request Forgery in OpenSolution Quick.Cart
## CVE Details
- CVE ID: CVE-2025-10317
- CVSS Score: Not provided (Severity not explicitly scored, but CSRF is generally High Impact)
- CWE: CWE-352 (Cross-Site Request Forgery)
## Affected Systems
- Products: OpenSolution Quick.Cart
- Versions: 6.7 (Confirmed vulnerable; other versions might also be vulnerable)
- Configurations: Any configuration utilizing the product creation functionality.
## Vulnerability Description
Quick.Cart is vulnerable to Cross-Site Request Forgery (CSRF) within its product creation functionality. The software lacks necessary protection mechanisms against this type of attack. A malicious attacker can craft a special website that, when visited by an authenticated administrator, automatically sends a forged POST request to create a product with content specified entirely by the attacker. All forms in this software are potentially vulnerable to CSRF.
## Exploitation
- Status: PoC available (Implied by the nature of the vulnerability being confirmed through testing, though formal PoC public availability is not stated, the technical details suggest easy crafting.)
- Complexity: Low (CSRF attacks targeting forms without anti-CSRF tokens are typically low complexity.)
- Attack Vector: Network (Requires convincing the victim to visit a malicious webpage.)
## Impact
- Confidentiality: Potential Disclosure (If context/metadata is included in forged requests or subsequent actions)
- Integrity: High (Unauthorized creation of products with attacker-defined content)
- Availability: Low (No direct impact on service uptime, but could lead to incorrect inventory/data)
## Remediation
### Patches
- None explicitly provided by the vendor in the report. The vendor was notified but did not respond with patch details or version ranges.
### Workarounds
- Implement alternative protection mechanisms on vulnerable forms (e.g., requiring a secondary confirmation step or implementing custom anti-CSRF tokens if possible).
- Administrators should exercise caution when browsing untrusted websites while logged into the Quick.Cart admin panel.
## Detection
- Detection methods and tools: Standard IDS/WAF rules looking for successful POST requests to product creation endpoints that lack expected session identifiers or CSRF tokens.
- Indicators of compromise: Unexpected product creation events logged in system audit trails that do not correspond to legitimate administrative actions.
## References
- Vendor advisories: None provided (Vendor has not responded with details).
- Relevant links - defanged:
- hxxps://www.cve.org/CVERecord?id=CVE-2025-10317
- hxxps://cert.pl/en/posts/2025/10/vulnerability-in-opensolution-quickcart-software/