An authenticated Insecure Direct Object Reference vulnerability in CS-Cart 4.18.3 allows malicious users to modify unauthorized account settings, posing a significant risk to data integrity.

The application fails to perform adequate server side validation of the company_id parameter within the user profile functionality. This allows an authenticated user to perform unauthorized modifications to account settings by manipulating object identifiers.

The exploitation of this IDOR vulnerability could lead to unauthorized modification of account configurations, potentially resulting in compromised user profile integrity or administrative confusion. With a CVSS score of 8.0, this flaw represents a high risk as it allows for unauthorized state changes within the application environment.

Immediate Action: Since no specific patch version is currently identified, users should contact CS-Cart support for guidance on applying security patches or hotfixes for version 4.18.3.

Proactive Monitoring: Review application access logs for unusual patterns involving the company_id parameter or frequent requests to the user profile update endpoint.

Compensating Controls: Deploy a Web Application Firewall (WAF) with custom rules designed to inspect and validate request parameters, specifically monitoring for unauthorized attempts to access or modify resources outside the scope of the current user session.

Public Exploit Available: Yes, a public proof-of-concept exists, as documented in the researcher's write-up on GitHub.

Given the high CVSS score and the presence of a public proof-of-concept, organizations running CS-Cart 4.18.3 should prioritize this issue. Administrative teams must restrict access to sensitive profile management functions and coordinate with the vendor to obtain the necessary remediation, as unauthorized modification of user settings can escalate into broader account takeover scenarios.