CVE-2011-5011

🗓️ 25 Dec 2011 01:00:00Reported by mitreType

cve🔗 web.nvd.nist.gov👁 38 Views🌐 WEB

CSRF vulnerabilities in xt:Commerce 3.0.4 SP2.1 & earlier allow remote attackers to hijack admin authentication

Reporter	Title	Published	Views	Family All 4
Cvelist	CVE-2011-5011	25 Dec 201101:00	–	cvelist
NVD	CVE-2011-5011	25 Dec 201101:55	–	nvd
Prion	Cross site request forgery (csrf)	25 Dec 201101:55	–	prion
Positive Technologies	PT-2011-5166 · Xt:Commerce · Xt:Commerce	25 Dec 201100:00	–	ptsecurity

NVD

Node

Source	Link
exchange	www.exchange.xforce.ibmcloud.com/vulnerabilities/71642
secunia	www.secunia.com/advisories/47032
osvdb	www.osvdb.org/77498
dishix	www.dishix.blogspot.com/p/xtcommerce-v304-sp21-cross-site-request_29.html
dishix	www.dishix.blogspot.com/2011/11/exploiting-xtcommerce-v304-sp21-cross.html

Parameter	Position	Path	Description	CWE
cID	query param	admin/customers.php	CSRF vulnerability: statusconfirm action allows changing user to Admin via cID parameter	CWE-352
cID	query param	admin/accounting.php	CSRF vulnerability: save action grants permissions via cID parameter	CWE-352

16 Jun 2026 23:35Current

7.5High risk

Vulners AI Score7.5

CVSS 26.8

EPSS0.03389