FKIE_CVE-2011-0503

Vulnerability from fkie_nvd - Published: 2011-01-20 19:00 - Updated: 2026-06-16 23:27
Severity
Summary
Cross-site request forgery (CSRF) vulnerability in VaM Shop 1.6, 1.6.1, and probably earlier versions allows remote attackers to hijack the authentication of administrators for requests that (1) change user status via admin/customers.php or (2) change user permissions via admin/accounting.php. NOTE: some of these details are obtained from third party information.
References
cve@mitre.orghttp://osvdb.org/70431
cve@mitre.orghttp://secunia.com/advisories/42869Vendor Advisory
cve@mitre.orghttp://www.exploit-db.com/exploits/15968
cve@mitre.orghttp://www.htbridge.ch/advisory/xsrf_csrf_in_vam_shop.htmlExploit
cve@mitre.orghttp://www.securityfocus.com/archive/1/515613/100/0/threaded
af854a3a-2127-422b-91ae-364da2661108http://osvdb.org/70431
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/42869Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://www.exploit-db.com/exploits/15968
af854a3a-2127-422b-91ae-364da2661108http://www.htbridge.ch/advisory/xsrf_csrf_in_vam_shop.htmlExploit
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/archive/1/515613/100/0/threaded
Impacted products
Vendor Product Version
vamsoft vam_shop *
vamsoft vam_shop 1.6
To clipboard 

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "source": "cve@mitre.org"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:vamsoft:vam_shop:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "A60D12D4-BA8D-459C-9FFD-756E9FC4E067",
              "versionEndIncluding": "1.6.1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:vamsoft:vam_shop:1.6:*:*:*:*:*:*:*",
              "matchCriteriaId": "7313C5D3-2FBD-4DB1-95B1-8C52406E59C2",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Cross-site request forgery (CSRF) vulnerability in VaM Shop 1.6, 1.6.1, and probably earlier versions allows remote attackers to hijack the authentication of administrators for requests that (1) change user status via admin/customers.php or (2) change user permissions via admin/accounting.php.  NOTE: some of these details are obtained from third party information."
    },
    {
      "lang": "es",
      "value": "M\u00faltiples vulnerabilidades de falsificaci\u00f3n de petici\u00f3n en sitios cruzados (CSRF) en VaM Shop v1.6, v1.6.1 y posiblemente anteriores versiones permite a atacantes remotos secuestrar la autenticaci\u00f3n de los administradores para (1) cambiar el estado de usuario mediante admin/customers.php o (2) cambiar permisos de usuario mediante admin/accounting.php. NOTA: algunos de estos detalles son obtenidos de terceros..."
    }
  ],
  "id": "CVE-2011-0503",
  "lastModified": "2026-06-16T23:27:31.253",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "MEDIUM",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "PARTIAL",
          "baseScore": 6.8,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
          "version": "2.0"
        },
        "exploitabilityScore": 8.6,
        "impactScore": 6.4,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": true
      }
    ]
  },
  "published": "2011-01-20T19:00:10.100",
  "references": [
    {
      "source": "cve@mitre.org",
      "url": "http://osvdb.org/70431"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/42869"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.exploit-db.com/exploits/15968"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Exploit"
      ],
      "url": "http://www.htbridge.ch/advisory/xsrf_csrf_in_vam_shop.html"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.securityfocus.com/archive/1/515613/100/0/threaded"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://osvdb.org/70431"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/42869"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.exploit-db.com/exploits/15968"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit"
      ],
      "url": "http://www.htbridge.ch/advisory/xsrf_csrf_in_vam_shop.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.securityfocus.com/archive/1/515613/100/0/threaded"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-352"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.