Overview :
Cross-site request forgery (CSRF) vulnerability in the Storefront Application in DS Data Systems KonaKart before allows remote attackers to hijack the authentication of administrators for requests that change a user email address via an unspecified GET request.
Affected Product(s) :
  • KonaKart Storefront Application prior to
Vulnerability Details :
CVE ID : CVE-2014-5516
The existing CSRF protection token was checked for every POST request properly. When modifying the request from POST method to GET method all state-changing actions worked as well, but the CSRF token protection was no longer enforced, allowing CSRF attacks.

Solution :

The vendor has released a XSRF fix as part of version at