CVE-2017-12415

OXID eShop Community Edition before 6.0.0 RC2 (development), 4.10.x before 4.10.5 (maintenance), and 4.9.x before 4.9.10 (legacy), Enterprise Edition before 6.0.0 RC2 (development), 5.2.x before 5.2.10 (legacy), and 5.3.x before 5.3.5 (maintenance), and Professional Edition before 6.0.0 RC2 (development), 4.9.x before 4.9.10 (legacy) and 4.10.x before 4.10.5 (maintenance) allow remote attackers to hijack the cart session of a client via Cross-Site Request Forgery (CSRF) if the following pre-conditions are met: (1) the attacker knows which shop is presently used by the client, (2) the attacker knows the exact time when the customer will add product items to the cart, (3) the attacker knows which product items are already in the cart (has to know their article IDs), and (4) the attacker would be able to trick user into clicking a button (submit form) of an e-mail or remote site within the period of visiting the shop and placing an order.

• CWE-352

• https://bugs.oxid-esales.com/view.php?id=6674Exploit, Third Party Advisory
• https://oxidforge.org/en/security-bulletin-2017-001.htmlVendor Advisory
• https://bugs.oxid-esales.com/view.php?id=6674Exploit, Third Party Advisory
• https://oxidforge.org/en/security-bulletin-2017-001.htmlVendor Advisory

Published

Feb 20, 2018

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2017-1240IBM Rhapsody DM products could reveal sensitive information …
• CVE-2017-1241An unspecified vulnerability in IBM Jazz Foundation based ap…
• CVE-2017-12410It is possible to exploit a Time of Check & Time of Use (TOC…
• CVE-2017-12412ccn-lite-ccnb2xml in CCN-lite before 2.0.0 allows context-de…
• CVE-2017-12413AXIS 2100 devices 2.43 have XSS via the URI, possibly relate…
• CVE-2017-12414Format Factory 4.1.0 has a DLL Hijacking Vulnerability becau…
• CVE-2017-12416Cross-site scripting (XSS) vulnerability in the GlobalProtec…
• CVE-2017-12418ImageMagick 7.0.6-5 has memory leaks in the parse8BIMW and f…
• CVE-2017-12419If, after successful installation of MantisBT through 2.5.2 …
• CVE-2017-1242IBM Quality Manager (RQM) 5.0.x and 6.0 through 6.0.5 are vu…5.4
• CVE-2017-12420Heap-based buffer overflow in the SMB implementation in NetA…
• CVE-2017-12421NetApp Clustered Data ONTAP 8.3.x before 8.3.2P12 allows rem…