KonaKart Storefront Application Cross Site Request Forgery

`-----BEGIN PGP SIGNED MESSAGE-----  
Hash: SHA1  
  
  
CVE-2014-5516  
===================  
"Cross-Site Request Forgery (CSRF) protection bypass" (CWE-352) vulnerability   
in "KonaKart Storefront Application" Enterprise Java eCommerce product  
  
  
Vendor  
===================  
DS Data Systems (UK) Ltd.  
  
  
Product  
===================  
"KonaKart is an affordable java based shopping cart software solution for online retailers.   
Let KonaKart help increase your eCommerce sales."  
- source: http://www.konakart.com  
  
"KonaKart is a Java eCommerce system aimed at medium to large online retailers."  
- source: https://en.wikipedia.org/wiki/KonaKart  
  
  
Affected versions  
===================  
This vulnerability affects versions of KonaKart Storefront Application prior to 7.3.0.0  
  
  
Patch  
===================  
The vendor has released a XSRF fix as part of version 7.3.0.0 at  
http://www.konakart.com/downloads/ver-7-3-0-0-whats-new  
  
  
Reported by  
===================  
This issue was reported to the vendor by Christian Schneider (@cschneider4711)   
following a responsible disclosure process.  
  
  
Severity  
===================  
Medium  
  
  
Description  
===================  
The existing CSRF protection token was checked for every POST request  
properly. When modifying the request from POST method to GET method   
all state-changing actions worked as well, but the CSRF token protection   
was no longer enforced, allowing CSRF attacks.  
  
  
Escalation potential  
====================  
Exploitation demonstration was responsibly provided along with the vulnerability   
report to the vendor, which changed a victim's mail address (using the CSRF   
protection bypass) to an attacker-supplied mail address, allowing a successful   
reset of victim's account password by the attacker.  
  
  
Timeline  
===================  
2014-05-02 Vulnerability discovered  
2014-05-02 Vulnerability responsibly reported to vendor  
2014-05-02 Reply from vendor acknowledging report  
2014-??-?? Vendor released patch as part of version 7.3.0.0  
2014-09-20 Advisory published via BugTraq  
  
  
References  
===================  
http://www.konakart.com/downloads/ver-7-3-0-0-whats-new  
http://www.christian-schneider.net/advisories/CVE-2014-5516.txt  
  
  
  
-----BEGIN PGP SIGNATURE-----  
Version: GnuPG v1.4.9 (Darwin)  
  
iEYEARECAAYFAlQd69cACgkQXYAsOfddvFOTVACgr/f5+x5kf60t5LaCqhH0pvSY  
QYoAnjiI0WSa3iGuw/OfXk3/vLV+liFm  
=61mn  
-----END PGP SIGNATURE-----  
`