CVE-2018-25435
ZeusCart 4.0 Deactivate Customer Accounts CSRF
- State
- Published
- Severity
- 6.9 Medium
- Published
- Jun 1, 2026
- Updated
- Jun 2, 2026
- Reserved
- Jun 1, 2026
Description
ZeusCart 4.0 contains a cross-site request forgery vulnerability that allows attackers to perform unauthorized actions on behalf of victims by crafting malicious requests. Attackers can deactivate customer accounts via the admin interface by tricking users into visiting attacker-controlled pages that submit requests to the regstatus endpoint with action=deny parameters.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 6.9 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:L/SI:L/SA:L | VulnCheck |
| 3.1 | 5.3 Medium | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N | VulnCheck |
Weaknesses
- CWE-352 Cross-Site Request Forgery (CSRF)
Affected Products
| Product | Versions |
|---|---|
ZeusCartzeuscart |
|
References
- ExploitDB-46027exploit
- Official Product Homepageproduct
- VulnCheck Advisory: ZeusCart 4.0 Deactivate Customer Accounts CSRFthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.