Quick.Cart contains a Cross‑Site Request Forgery weakness that allows an attacker to craft a malicious webpage which, when an administrator visits, automatically submits a POST request to the admin configuration panel to change the administrator’s login and password. This flaw is a classic instance of CWE‑352 and enables a remote actor to alter privileged credentials without legitimate authentication, thereby compromising confidentiality and integrity of the admin account.

The vulnerability is present in the OpenSolution Quick.Cart software, specifically all releases prior to patch version 6.7. All administrative configuration forms in the application are potentially exploitable, so any deployment using Quick.Cart without the 6.7 update remains at risk.

The CVSS score of 6.9 reflects a moderate severity balanced against the fact that the flaw can be exploited through CSRF alone, without additional access or privilege escalation. EPSS is not available, so the exact likelihood of exploitation is unknown; however, the issue is not yet listed in the CISA KEV catalog, suggesting it has not yet been widely abused. Attackers can bypass simple referer‑based checks by manipulating the Referer header, indicating that the attack does not require elevated system privileges or specialized infrastructure.