Description
nopCommerce before 5.00.0 contains a missing authorization vulnerability in the admin ProductController RelatedProductAddPopup, CrossSellProductAddPopup and AssociatedProductAddPopup handlers that fail to verify parent product ownership. Authenticated vendors can submit another vendor's product id as model.ProductId to inject their products into the victim's related-products, cross-sell and grouped-product listings.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
nopSolutions nopCommerce
Default version status: unaffected
0 to < 5.00.0affected
pkg:github/nopSolutions/nopCommerceReferences
- https://github.com/nopSolutions/nopCommerce/issues/8417 ↗
- https://github.com/nopSolutions/nopCommerce/commit/fbdbe18d43b42b7e269f7118cfc9533349ed2dc0 ↗
- https://github.com/nopSolutions/nopCommerce/blob/918444773367deb734b93d3ad80e17325d6c147a/src/Presentation/Nop.Web/Areas/Admin/Controllers/ProductController.cs#L1655-L1679 ↗
- https://github.com/nopSolutions/nopCommerce/releases/tag/release-5.00.0 ↗
- https://github.com/nopSolutions/nopCommerce ↗
- https://www.vulncheck.com/advisories/nopcommerce-before-5.00.0-missing-authorization-via-admin-productcontroller-add-popup-handlers ↗