CVE-2019-6249 in HuCart
Summary
by MITRE
An issue was discovered in HuCart v5.7.4. There is a CSRF vulnerability that can add an admin account via /adminsys/index.php?load=admins&act=edit_info&act_type=add.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/23/2025
The vulnerability identified as CVE-2019-6249 resides within the HuCart e-commerce platform version 5.7.4, specifically targeting the administrative user management functionality. This issue represents a critical cross-site request forgery vulnerability that allows unauthorized attackers to escalate privileges by creating administrative accounts without proper authentication. The vulnerability manifests through a specific endpoint at /adminsys/index.php?load=admins&act=edit_info&act_type=add which lacks adequate protection mechanisms against forged requests originating from malicious web pages or applications.
The technical flaw stems from the absence of proper anti-cross-site request forgery tokens or validation mechanisms within the administrative account creation process. When an authenticated administrator visits a malicious website or clicks on a crafted link, the browser automatically submits a request to the vulnerable endpoint without requiring additional authentication or confirmation from the user. This behavior violates fundamental security principles for protecting administrative functions, as the system fails to verify the authenticity of the request source or ensure that the action was intentionally initiated by the legitimate administrator.
The operational impact of this vulnerability is severe and far-reaching within the context of e-commerce security. An attacker who successfully exploits this CSRF flaw can gain full administrative privileges on the affected HuCart installation, potentially leading to complete system compromise. This includes access to sensitive customer data, financial transaction records, product inventory management, and the ability to modify or delete critical system components. The vulnerability essentially provides a backdoor for attackers to establish persistent administrative access, making it particularly dangerous for online businesses handling sensitive commerce data.
From a cybersecurity perspective, this vulnerability aligns with CWE-352, which specifically addresses Cross-Site Request Forgery issues, and maps to ATT&CK technique T1078.004 for valid accounts and T1566.001 for spearphishing attachments or links. The attack surface is particularly concerning as it requires no prior authentication or exploitation of other vulnerabilities, making it accessible to attackers with basic web security knowledge. Organizations using HuCart v5.7.4 should immediately implement mitigations including the addition of anti-CSRF tokens to all administrative endpoints, implementation of referer header validation, and enforcement of same-site cookies. Additionally, the vendor should be notified to provide a security patch addressing this vulnerability, as the affected version represents an outdated release that likely contains other undiscovered security weaknesses.