Vulnerabilitas in Quick.Cart software

CVE ID

CVE-2026-41875

Publication date

29 September 2026

Vendor

OpenSolution

Product

Quick.Cart

Vulnerable versions

Omnes usque ad 6.7.0

Vulnerability type (CWE)

Cross-Site Request Forgery (CSRF) (CWE-352)

Report source

Report to CERT Polska

Description

CERT Polska nuntium de vulnerabilitate in Quick.Cart software accepit et in coordinatione eius revelationis participavit.

Vulnerabilitas CVE-2026-41875: Quick.Cart vulnerabilis est ad Cross-Site Request Forgery in paneli configurationis admin. Malitiosus oppugnator potest specialem website conficere, quae cum ab admin visitatur, statim mittet petitionem POST quae login et password adminis mutat.

Hoc software simplicem protectionem contra hanc type oppugnationis implementat, sed facile superatur per manipulandum caput referer. Omnes formae in hoc software praesto sunt potentia vulnerabiles.

Haec quaestio in patch ad versionem 6.7 die 09.11.2026 emendata est, deploymentes sine hoc patch adhuc vulnerabiles sunt.

Credits

Gratias agimus Karol Czubernat pro responsabili nuntio vulnerabilitatis.

Plura de processu revelationis vulnerabilitatis coordinatae apud CERT Polska inveniuntur ad https://cert.pl/en/cvd/.

Vulnerabilitates Relatae

CVE-2026-41875 CVSS 6.9 MEDIUM Deferred

CVE-2026-41875 - Cross-Site Request Forgery in admin panel of Quick.Cart

Quick.Cart is vulnerable to Cross-Site Request Forgery in admin config panel. Malicious attacker can craft special website, which when visited by the admin, will automatically send a POST request that changes admin's login and password. This software does implement simple protection against this type of attack, but it is easily bypassed by manipulating the referer header. All forms available in this software are potentially vulnerable. This issue was fixed in a patch to version 6.7 published on 09.11.2026, deployments without this patch are still vulnerable

Vulnerabilitas in Quick.Cart software

Vulnerabilitates Relatae

Plura ex cert.pl