Quick.Cart vulnerabilities

Quick.Cart is vulnerable to Cross-Site Request Forgery in admin config panel. Malicious attacker can craft special website, which when visited by the admin, will automatically send a POST request that changes admin's login and password. This software does implement simple protection against this type of attack, but it is easily bypassed by manipulating the referer header. All forms available in this software are potentially vulnerable. This issue was fixed in a patch to version 6.7 published on 09.11.2026, deployments without this patch are still vulnerable.

Quick.Cart stores hard-coded, plaintext admin credentials in a configuration file. Attackers with server file system access can retrieve them, potentially leading to privilege escalation. The vendor assessed risk as very low and will not fix. Version 6.7 tested, but all versions are vulnerable.

Quick.Cart is vulnerable to Cross-Site Request Forgery in product creation functionality. A malicious attacker can craft a special website, which when visited by the admin, will automatically send a POST request creating a malicious product with content defined by the attacker. The software does not implement any protection against this type of attack, and all forms are potentially vulnerable. Only version 6.7 was tested and confirmed as vulnerable.