WordPress Cart66 Lite Plugin CVE-2013-5977 Cross Site Request Forgery Vulnerability

Bugtraq ID:	62975
Class:	Design Error
CVE:	CVE-2013-5977
Remote:	Yes
Local:	No
Published:	Oct 11 2013 12:00AM
Updated:	Oct 11 2013 12:00AM
Credit:	absane
Vulnerable:
Not Vulnerable:

WordPress Cart66 Lite Plugin CVE-2013-5977 Cross Site Request Forgery Vulnerability

Cart66 Lite plugin for WordPress is prone to a cross-site request-forgery vulnerability.

Exploiting this issue may allow a remote attacker to perform certain unauthorized actions in the context of the affected application. Other attacks are also possible.

Cart66 Lite 1.5.1.14 is vulnerable; other versions may also be affected.

WordPress Cart66 Lite Plugin CVE-2013-5977 Cross Site Request Forgery Vulnerability

To exploit this issue an attacker must entice an unsuspecting victim to open a malicious URI.

The following example request is available:

• /data/vulnerabilities/exploits/62975.html

WordPress Cart66 Lite Plugin CVE-2013-5977 Cross Site Request Forgery Vulnerability

Solution:
Reportedly the issue is fixed, however Symantec has not confirmed this. Please contact the vendor for more information.

WordPress Cart66 Lite Plugin CVE-2013-5977 Cross Site Request Forgery Vulnerability

References:

• WordPress Homepage (WordPress)