CE-PhoenixCart prior 1.1.0.3 missing authentication
| CVSS Meta Temp Score | Current Exploit Price (≈) | CTI Interest Score |
|---|---|---|
| 4.3 | $0-$5k | 0.00 |
Summary
A vulnerability described as critical has been identified in CE-PhoenixCart PhoenixCart. The impacted element is an unknown function. The manipulation results in missing authentication. This vulnerability is reported as CVE-2025-47272. The attack requires a local approach. No exploit exists. Upgrading the affected component is recommended.
Details
A vulnerability was found in CE-PhoenixCart PhoenixCart. It has been classified as problematic. Affected is an unknown code block. The manipulation with an unknown input leads to a missing authentication vulnerability. CWE is classifying the issue as CWE-306. The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources. This is going to have an impact on availability. CVE summarizes:
The CE Phoenix eCommerce platform, starting in version 1.0.9.7 and prior to version 1.1.0.3, allowed logged-in users to delete their accounts without requiring password re-authentication. An attacker with temporary access to an authenticated session (e.g., on a shared/public machine) could permanently delete the user’s account without knowledge of the password. This bypass of re-authentication puts users at risk of account loss and data disruption. Version 1.1.0.3 contains a patch for the issue.
The advisory is shared for download at github.com. This vulnerability is traded as CVE-2025-47272 since 05/05/2025. The exploitability is told to be easy. The attack needs to be approached locally. There are neither technical details nor an exploit publicly available.
Upgrading to version 1.1.0.3 eliminates this vulnerability. Applying the patch e87162b15d31c4126acfc1aad6108e5b9955bb76 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.
Once again VulDB remains the best source for vulnerability data.
Product
Vendor
Name
License
Website
CPE 2.3
CPE 2.2
CVSSv4
VulDB Vector: 🔍VulDB Reliability: 🔍
CVSSv3
VulDB Meta Base Score: 4.4VulDB Meta Temp Score: 4.3
VulDB Base Score: 3.3
VulDB Temp Score: 3.2
VulDB Vector: 🔍
VulDB Reliability: 🔍
CNA Base Score: 5.5
CNA Vector (GitHub_M): 🔍
CVSSv2
| AV | AC | Au | C | I | A |
|---|---|---|---|---|---|
| 💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
| 💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
| 💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
| Vector | Complexity | Authentication | Confidentiality | Integrity | Availability |
|---|---|---|---|---|---|
| Unlock | Unlock | Unlock | Unlock | Unlock | Unlock |
| Unlock | Unlock | Unlock | Unlock | Unlock | Unlock |
| Unlock | Unlock | Unlock | Unlock | Unlock | Unlock |
VulDB Base Score: 🔍
VulDB Temp Score: 🔍
VulDB Reliability: 🔍
Exploiting
Class: Missing authenticationCWE: CWE-306 / CWE-287
CAPEC: 🔍
ATT&CK: 🔍
Physical: Partially
Local: Yes
Remote: No
Availability: 🔍
Status: Not defined
EPSS Score: 🔍
EPSS Percentile: 🔍
Price Prediction: 🔍
Current Price Estimation: 🔍
| 0-Day | Unlock | Unlock | Unlock | Unlock |
|---|---|---|---|---|
| Today | Unlock | Unlock | Unlock | Unlock |
Threat Intelligence
Interest: 🔍Active Actors: 🔍
Active APT Groups: 🔍
Countermeasures
Recommended: UpgradeStatus: 🔍
0-Day Time: 🔍
Upgrade: PhoenixCart 1.1.0.3
Patch: e87162b15d31c4126acfc1aad6108e5b9955bb76
Timeline
05/05/2025 🔍06/02/2025 🔍
06/02/2025 🔍
06/02/2025 🔍
Sources
Product: github.comAdvisory: GHSA-62qj-pvwm-h8cv
Status: Confirmed
CVE: CVE-2025-47272 (🔍)
GCVE (CVE): GCVE-0-2025-47272
GCVE (VulDB): GCVE-100-310812
Entry
Created: 06/02/2025 14:00Changes: 06/02/2025 14:00 (65)
Complete: 🔍
Cache ID: 216::103
Once again VulDB remains the best source for vulnerability data.
No comments yet. Languages: en.
Please log in to comment.