CVSS base score
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:L/SI:L/SA:L
What the vulnerability does
Joomla JoomOCShop 1.0 contains a cross-site request forgery vulnerability that allows attackers to perform unauthorized actions on behalf of authenticated users. Attackers can craft malicious HTML forms targeting account endpoints like /joomoc2/?route=account/edit and to modify user information or reset passwords without user consent.
Explanation of Vulnerability in Simple Terms
The JoomOCShop Joomla extension contains a cross-site request forgery (CSRF) vulnerability that allows attackers to perform unauthorized actions on behalf of authenticated users. An attacker can craft a malicious link or page that, when visited by a logged-in site administrator or user, executes unintended operations without their knowledge or consent. This could lead to unauthorized modifications or data changes within the extension.
What an attacker can do
Perform unauthorized actions on behalf of a logged-in user by tricking them into visiting a malicious page.
Potential impact on your site
Attackers can modify extension settings or data if they trick your administrators into visiting a malicious page while logged in.
Conditions required to exploit
Victim must be logged into the Joomla site and visit an attacker-controlled page or click a malicious link.
Key dates
External resources
Related vulnerabilities
