Description (CNA)
Cross-site request forgery (CSRF) in NewsItemApiController in SimplCommerce prior to commit 6233d73e allows an unauthenticated remote attacker to create or modify news items as an administrator via a crafted form submitted to `/api/news-items`, due to missing anti-CSRF protection.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| simplcommerce / SimplCommerce | affected 0 before 6233d73e |
CWE
CWE-352
References
- https://github.com/simplcommerce/SimplCommerce/pull/1150
- https://github.com/simplcommerce/SimplCommerce/commit/6233d73e134c887fc3f3308d20710bec096d45e3
ADP enrichment
No English description supplied.
No references supplied.