CVE-2025-10317
MediumCVSS 5.1Exploitation Probability (EPSS)
Low risk10th percentile - higher than 10% of all known CVEs
Summary
Quick.Cart is vulnerable to Cross-Site Request Forgery in product creation functionality. A malicious attacker can craft a special website, which when visited by the admin, will automatically send a POST request creating a malicious product with content defined by the attacker. The software does not implement any protection against this type of attack, and all forms are potentially vulnerable. Only version 6.7 was tested and confirmed as vulnerable.
Risk Assessment
An attacker can unauthorizedly create products in the store, potentially leading to manipulation of the offer, fraud, or further attacks on the administrator.
Recommendation
Update Quick.Cart to the latest version if available, and implement CSRF protection mechanisms such as tokens in all forms. Restrict access to the admin panel and educate administrators about the risks of visiting unknown websites.
Other vulnerabilities in Quick.Cart
See all- CVE-2026-41875Medium
Quick.Cart is vulnerable to Cross-Site Request Forgery in admin config panel. Malicious attacker can craft special website, which when visited by the admin, will automatically send a POST request that changes admin's login and password. This software does implement simple protection against this type of attack, but it is easily bypassed by manipulating the referer header. All forms available in this software are potentially vulnerable. This issue was fixed in a patch to version 6.7 published on 09.11.2026, deployments without this patch are still vulnerable.
- CVE-2026-41874Medium
Quick.Cart stores hard-coded, plaintext admin credentials in a configuration file. Attackers with server file system access can retrieve them, potentially leading to privilege escalation. The vendor assessed risk as very low and will not fix. Version 6.7 tested, but all versions are vulnerable.
Original NVD description (English source)
Quick.Cart is vulnerable to Cross-Site Request Forgery in product creation functionality. Malicious attacker can craft special website, which when visited by the admin, will automatically send a POST request creating a malicious product with content defined by the attacker. This software does not implement any protection against this type of attack. All forms available in this software are potentially vulnerable. The vendor was notified early about this vulnerability, but didn't respond with the details of vulnerability or vulnerable version range. Only version 6.7 was tested and confirmed as vulnerable, other versions were not tested and might also be vulnerable.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS