Cross site request forgery (csrf)

Advisto PEEL Shopping 9.2.1 has CSRF via administrer/utilisateurs.php to delete a user...

CVE-2019-20178

Advisto PEEL Shopping 9.2.1 is affected by a Cross-Site Request Forgery (CSRF) via administrer/utilisateurs.php that can be used to delete a user. The issue is described across multiple sources (e.g., NVD entry CVE-2019-20178 and Red Hat/CVE mirrors) as a CSRF vulnerability in the web application...

PT-2020-10359

Name of the Vulnerable Software and Affected Versions Advisto PEEL Shopping version 9.2.1 Description The issue allows for CSRF via the "administrer/utilisateurs.php" endpoint to delete a user. Recommendations For Advisto PEEL Shopping version 9.2.1, consider implementing proper CSRF protection...