« Volver al listado

CVE-2011-0503

Estado: ModificadaMedia (6.8)—💥 Exploit

Múltiples vulnerabilidades de falsificación de petición en sitios cruzados (CSRF) en VaM Shop v1.6, v1.6.1 y posiblemente anteriores versiones permite a atacantes remotos secuestrar la autenticación de los administradores para (1) cambiar el estado de usuario mediante admin/customers.php o (2) cambiar permisos de usuario mediante admin/accounting.php. NOTA: algunos de estos detalles son obtenidos de terceros...

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

💥 Exploits públicos

Hay código de explotación o plantillas de detección públicos. No es lo mismo que explotación activa confirmada (KEV), pero aumenta el riesgo: parchee con prioridad.

Tecnologías afectadas (1)

Vamsoft — VAM Shop

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2011-0503",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 6.8,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": true
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2011-01-20T19:00:10.100",
  "references": [
    {
      "url": "http://osvdb.org/70431",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://secunia.com/advisories/42869",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.exploit-db.com/exploits/15968",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.htbridge.ch/advisory/xsrf_csrf_in_vam_shop.html",
      "tags": [
        "Exploit"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.securityfocus.com/archive/1/515613/100/0/threaded",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://osvdb.org/70431",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://secunia.com/advisories/42869",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.exploit-db.com/exploits/15968",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.htbridge.ch/advisory/xsrf_csrf_in_vam_shop.html",
      "tags": [
        "Exploit"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/archive/1/515613/100/0/threaded",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-352"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Cross-site request forgery (CSRF) vulnerability in VaM Shop 1.6, 1.6.1, and probably earlier versions allows remote attackers to hijack the authentication of administrators for requests that (1) change user status via admin/customers.php or (2) change user permissions via admin/accounting.php.  NOTE: some of these details are obtained from third party information."
    },
    {
      "lang": "es",
      "value": "Múltiples vulnerabilidades de falsificación de petición en sitios cruzados (CSRF) en VaM Shop v1.6, v1.6.1 y posiblemente anteriores versiones permite a atacantes remotos secuestrar la autenticación de los administradores para (1) cambiar el estado de usuario mediante admin/customers.php o (2) cambiar permisos de usuario mediante admin/accounting.php. NOTA: algunos de estos detalles son obtenidos de terceros..."
    }
  ],
  "lastModified": "2026-06-16T23:27:31.253",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:vamsoft:vam_shop:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A60D12D4-BA8D-459C-9FFD-756E9FC4E067",
              "versionEndIncluding": "1.6.1"
            },
            {
              "criteria": "cpe:2.3:a:vamsoft:vam_shop:1.6:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7313C5D3-2FBD-4DB1-95B1-8C52406E59C2"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}