CVE-2010-1611

MediumCVSS 6.8/10Last modified Jun 16, 2026

Description

Cross-site request forgery (CSRF) vulnerability in AlegroCart 1.1 allows remote attackers to hijack the authentication of the administrator for requests that reset the administrator password via a POST to admin/ with an update action.

Metrics

CVSS 2.0 6.8/10AV:N/AC:M/Au:N/C:P/I:P/A:P

Weakness enumeration

CWE-352

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://forum.alegrocart.com/viewtopic.php?f=8&t=54Patch, Vendor Advisory
http://osvdb.org/62073
http://packetstormsecurity.org/1002-exploits/alegrocart-xsrf.txtExploit
http://secunia.com/advisories/38386Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/56037
http://forum.alegrocart.com/viewtopic.php?f=8&t=54Patch, Vendor Advisory
http://osvdb.org/62073
http://packetstormsecurity.org/1002-exploits/alegrocart-xsrf.txtExploit
http://secunia.com/advisories/38386Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/56037

Timeline

Published: Apr 29, 2010
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2010

CVE-2010-16125.0The IBM WebSphere DataPower XML Accelerator XA35, Low Latency Appliance XM70, Integration Appliance XI50, B2B Appliance XB60, and XML Securi CVE-2010-16136.8Moodle 1.8.x and 1.9.x before 1.9.8 does not enable the "Regenerate session id during login" setting by default, which makes it easier for r CVE-2010-16144.3Multiple cross-site scripting (XSS) vulnerabilities in Moodle 1.8.x before 1.8.12 and 1.9.x before 1.9.8 allow remote attackers to inject ar CVE-2010-16157.5Multiple SQL injection vulnerabilities in Moodle 1.8.x before 1.8.12 and 1.9.x before 1.9.8 allow remote attackers to execute arbitrary SQL CVE-2010-16164.0Moodle 1.8.x and 1.9.x before 1.9.8 can create new roles when restoring a course, which allows teachers to create new accounts even if they CVE-2010-16174.0user/view.php in Moodle 1.8.x before 1.8.12 and 1.9.x before 1.9.8 does not properly check a role, which allows remote authenticated users t CVE-2010-16184.3Cross-site scripting (XSS) vulnerability in the phpCAS client library before 1.1.0, as used in Moodle 1.8.x before 1.8.12 and 1.9.x before 1 CVE-2010-16194.3Cross-site scripting (XSS) vulnerability in the fix_non_standard_entities function in the KSES HTML text cleaning library (weblib.php), as u CVE-2010-16207.2Integer overflow in the load_iface function in Tools/gdomap.c in gdomap in GNUstep Base before 1.20.0 might allow context-dependent attacker CVE-2010-16215.0The mysql_uninstall_plugin function in sql/sql_plugin.cc in MySQL 5.1 before 5.1.46 does not check privileges before uninstalling a plugin, CVE-2010-16226.0SpringSource Spring Framework 2.5.x before 2.5.6.SEC02, 2.5.7 before 2.5.7.SR01, and 3.0.x before 3.0.3 allows remote attackers to execute a CVE-2010-16235.0Memory leak in the apr_brigade_split_line function in buckets/apr_brigade.c in the Apache Portable Runtime Utility library (aka APR-util) be