ZeusCart Cross-Site Request Forgery Vulnerability Allowing Account Deactivation

A cross-site request forgery (CSRF) vulnerability has been identified in ZeusCart version 4.0. This vulnerability allows attackers to perform unauthorized actions on behalf of users by sending crafted requests. Specifically, attackers can deactivate customer accounts through the admin interface by persuading users to visit maliciously controlled pages that trigger requests to the regstatus endpoint with action=deny parameters.

Impact

Exploitation of this vulnerability allows for the unauthorized deactivation of customer accounts, banning them from logging in.

Reproduction

To reproduce this vulnerability, an attacker must create a webpage that sends a request to the ZeusCart admin regstatus endpoint, including the action=deny parameter and the ID of the account to be deactivated. When a user visits this page, their account will be deactivated without their consent.