Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Vulnerability Description
Multiple cross-site request forgery (CSRF) vulnerabilities in Shopizer 1.1.5 and earlier allow remote attackers to hijack the authentication of users for requests that (1) modify customer settings or hijack the authentication of administrators for requests that change (2) customer passwords, (3) shop configuration, or (4) product details, as demonstrated by (5) modify a product's price via a crafted request to central/catalog/saveproduct.action or (6) creating a product review via a crafted request to shop/product/createReview.action.
CVSS Information
N/A
Vulnerability Type
N/A
Vulnerability Title
Shopizer 跨站请求伪造漏洞
Vulnerability Description
Shopizer是Shopizer社区开发的一套使用Hibernate、Spring、Struts2、jQuery等技术框架开发的基于Web的销售管理和电子商务内容管理系统（CMS）。该系统包括购物车、库存管理，付款和运输，订单管理等功能。 Shopizer 1.1.5及之前的版本中存在跨站请求伪造漏洞。远程攻击者可利用该漏洞执行未授权操作如：修改顾客设置，顾客密码，商店配置或商品详细信息，修改商品价格，创建商品评论。
CVSS Information
N/A
Vulnerability Type
N/A