CVE-2025-50850

An issue was discovered in CS Cart 4.18.3 allows the vendor login functionality lacks essential security controls such as CAPTCHA verification and rate limiting. This allows an attacker to systematically attempt various combinations of usernames and passwords (brute-force attack) to gain unauthorized access to vendor accounts. The absence of any blocking mechanism makes the login endpoint susceptible to automated attacks.

CVSS v3 8.6 HIGH

8.6^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 4.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
http://cs.com	Not Applicable
https://github.com/hackerwahab/CS-Cart-Vulns/blob/main/CVE-2025-50850.md	Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:cs-cart:cs-cart:4.18.3:*:*:*:*:*:*:*

History

No history.

Information

Published : 2025-07-31 16:15

Updated : 2025-08-06 16:34

NVD link : CVE-2025-50850

Mitre link : CVE-2025-50850

CVE.ORG link : CVE-2025-50850

JSON object : View

Products Affected

cs-cart

cs-cart

CWE

CWE-284

Improper Access Control

CWE-804

Guessable CAPTCHA

{"id": "CVE-2025-50850", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.6, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 4.7, "exploitabilityScore": 3.9}]}, "published": "2025-07-31T16:15:31.163", "references": [{"url": "http://cs.com", "tags": ["Not Applicable"], "source": "[email protected]"}, {"url": "https://github.com/hackerwahab/CS-Cart-Vulns/blob/main/CVE-2025-50850.md", "tags": ["Third Party Advisory"], "source": "[email protected]"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-284"}, {"lang": "en", "value": "CWE-804"}]}], "descriptions": [{"lang": "en", "value": "An issue was discovered in CS Cart 4.18.3 allows the vendor login functionality lacks essential security controls such as CAPTCHA verification and rate limiting. This allows an attacker to systematically attempt various combinations of usernames and passwords (brute-force attack) to gain unauthorized access to vendor accounts. The absence of any blocking mechanism makes the login endpoint susceptible to automated attacks."}, {"lang": "es", "value": "Se descubri\u00f3 un problema en CS Cart 4.18.3 que permite que la funci\u00f3n de inicio de sesi\u00f3n del proveedor carezca de controles de seguridad esenciales, como la verificaci\u00f3n CAPTCHA y la limitaci\u00f3n de velocidad. Esto permite que un atacante intente sistem\u00e1ticamente diversas combinaciones de nombres de usuario y contrase\u00f1as (ataque de fuerza bruta) para obtener acceso no autorizado a las cuentas del proveedor. La ausencia de cualquier mecanismo de bloqueo hace que el endpoint de inicio de sesi\u00f3n sea vulnerable a ataques automatizados."}], "lastModified": "2025-08-06T16:34:48.977", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:cs-cart:cs-cart:4.18.3:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "697E87F8-685B-468D-8876-535E807BA897"}], "operator": "OR"}]}], "sourceIdentifier": "[email protected]"}