CVE-2026-41875: Cross-Site Request Forgery in admin panel of Quick.Cart
Quick.Cart is vulnerable to Cross-Site Request Forgery in admin config panel. Malicious attacker can craft special website, which when visited by the admin, will automatically send a POST request that changes admin's login and password. This software does implement simple protection against this type of attack, but it is easily bypassed by manipulating the referer header. All forms available in this software are potentially vulnerable.
This issue was fixed in a patch to version 6.7 published on 09.11.2026, deployments without this patch are still vulnerable
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Quick.Cartto a version that resolves this vulnerability.Fixed in 6.7
Event History
Frequently Asked Questions
Who is exposed to this issue?
Deployments of Quick.Cart that do not have the patch to version 6.7 published on 09.11.2026 are vulnerable. The attack targets an administrator who visits an attacker-controlled website while authenticated to the admin panel.
What does an attacker need to exploit it?
The attacker needs to entice an authenticated administrator into visiting a specially crafted website. That site can automatically submit a POST request to the admin configuration panel, including requests that change the administrator login and password.
Are only credential-change functions affected?
No. The available information states that all forms in the software are potentially vulnerable, not only the form used to change administrator credentials.
Is the existing CSRF protection sufficient?
No. Quick.Cart has simple CSRF protection, but it can be bypassed by manipulating the Referer header.