CVE-2018-25435

MediumCVSS 5.3

Published: 01/06/2026(UTC)Updated: 22/07/2026(UTC)Translated: 23/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.16%

5th percentile - higher than 5% of all known CVEs

Summary

ZeusCart 4.0 contains a cross-site request forgery (CSRF) vulnerability that allows attackers to perform unauthorized actions on behalf of victims, such as deactivating customer accounts via the regstatus endpoint with action=deny parameters.

Risk Assessment

An attacker can trick an administrator into performing unwanted actions, potentially leading to account deactivation, store disruption, or other damage.

Recommendation

Implement CSRF tokens in all forms and sensitive requests, and restrict access to administrative endpoints to authenticated sessions only.

Other vulnerabilities in ZeusCart

CVE-2015-2183High
Multiple SQL injection vulnerabilities in the administrative backend in ZeusCart 4 allow remote administrators to execute arbitrary SQL commands via the id parameter in disporders detail, subadminmgt edit actions, or the cid parameter in an editcurrency action.

Original NVD description (English source)

ZeusCart 4.0 contains a cross-site request forgery vulnerability that allows attackers to perform unauthorized actions on behalf of victims by crafting malicious requests. Attackers can deactivate customer accounts via the admin interface by tricking users into visiting attacker-controlled pages that submit requests to the regstatus endpoint with action=deny parameters.