Overview :
Cross-site request forgery (CSRF) vulnerability in the Storefront Application in DS Data Systems KonaKart before 7.3.0.0 allows remote attackers to hijack the authentication of administrators for requests that change a user email address via an unspecified GET request.
Affected Product(s) :
  • KonaKart Storefront Application prior to 7.3.0.0
Vulnerability Details :
CVE ID :CVE-2014-5516
The existing CSRF protection token was checked for every POST request properly. When modifying the request from POST method to GET method all state-changing actions worked as well, but the CSRF token protection was no longer enforced, allowing CSRF attacks.

Solution :

The vendor has released a XSRF fix as part of version 7.3.0.0 at

http://www.konakart.com/downloads/ver-7-3-0-0-whats-new