Vulnerability in Cs-Cart
CVE-2013-0118
CS-Cart before 3.0.6, when PayPal Standard Payments is configured, allows remote attackers to set the payment recipient via a modified value of the merchant's e-mail address, as demonstrated by setting the recipient to one's self.
EPSS: 0.017 (75.2th percentile) — read the EPSS interpretation.
Affected products
- Cs-cart — versions 3.0, 3.0.2, 3.0.3
- N/a — versions n/a
Weakness classification (CWE)
References
- cret@cert.org (US Government Resource, x_refsource_CERT-VN, third-party-advisory)
- cret@cert.org (x_refsource_CONFIRM)