EUVD-2026-41813
GHSA-p382-hpg8-f9gw
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-delivered CSRF requiring victim click (UI:R, PR:N); impact is integrity-only and limited to victim's own session scope (S:U, I:L, C:N, A:N).
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A weakness has been identified in imhamzaazam ecommerceFlask up to cb7d9e24c30a99379651b7493b32048126ef402b. The affected element is an unknown function. This manipulation causes cross-site request forgery. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The project was informed of the problem early through an issue report but has not responded yet.
AnalysisAI
Cross-site request forgery in imhamzaazam ecommerceFlask allows a remote, unauthenticated attacker to induce authenticated victims into executing unauthorized state-changing actions against the application. The vulnerability exists in an unspecified function of the Flask-based e-commerce application up to commit cb7d9e24c30a99379651b7493b32048126ef402b, with no patch released and the project maintainer not yet responding. A publicly available proof-of-concept exploit has been disclosed via a GitHub issue, and the application's rolling release model means no fixed version can be identified.
Technical ContextAI
ecommerceFlask (CPE: cpe:2.3:a:imhamzaazam:ecommerceflask:*:*:*:*:*:*:*:*) is a Python Flask-based e-commerce web application maintained by imhamzaazam. CWE-352 (Cross-Site Request Forgery) is the root cause class: the application fails to validate that state-changing HTTP requests originate from the legitimate application interface rather than a third-party page. Flask does not enforce CSRF protection natively - it must be implemented explicitly via extensions such as Flask-WTF or by embedding and validating per-session tokens in forms. The absence of this control allows an attacker's page to silently submit crafted requests using the victim's existing browser session. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P) confirms the attack is network-reachable with no special attack requirements, though passive victim interaction is required.
RemediationAI
No vendor-released patch has been identified at time of analysis - the project maintainer has not responded to the responsible disclosure. Operators of this application should immediately implement CSRF protection by integrating Flask-WTF (which provides flask_wtf.csrf.CSRFProtect) and enabling the CsrfProtect extension globally, ensuring all state-changing POST/PUT/DELETE routes validate a synchronizer token. As a compensating control, deploying a reverse proxy (e.g., nginx) with strict SameSite=Strict cookie attribute enforcement will prevent cross-origin requests from carrying session cookies in most modern browsers, though this does not fix the root cause. Restricting the application to an internal network or VPN if public exposure is not required eliminates the network attack surface entirely. The GitHub issue at https://github.com/imhamzaazam/ecommerceFlask/issues/1 and VulDB entry at https://vuldb.com/vuln/376394 should be monitored for any maintainer response or patch commit.
Same weakness CWE-352 – Cross-Site Request Forgery (CSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today