Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
CubeCart Unauthorized Newsletter Unsubscription via force_unsubscribe Parameter
Vulnerability Description
CubeCart is an ecommerce software solution. Prior to version 6.5.11, a logic flaw exists in the newsletter subscription endpoint that allows an attacker to unsubscribe any user without their consent. By changing the value of the force_unsubscribe parameter in the POST request to 1, an attacker can force the removal of any valid subscriber’s email address. This issue has been patched in version 6.5.11.
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Vulnerability Type
授权机制缺失
Vulnerability Title
CubeCart 安全漏洞
Vulnerability Description
CubeCart是CubeCart开源的一个电子商务软件。 CubeCart 6.5.11之前版本存在安全漏洞，该漏洞源于newsletter subscription端点存在逻辑缺陷，可能导致未经用户同意取消订阅。
CVSS Information
N/A
Vulnerability Type
N/A