A lack of authentication security controls in CS-Cart 4.18.3 exposes vendor accounts to unauthorized access via brute-force attacks.

This vulnerability is an authentication bypass and brute-force weakness within the vendor login functionality. It allows an unauthenticated attacker to continuously attempt credential guessing without interference from rate limiting or CAPTCHA verification.

The potential for unauthorized access to vendor accounts poses a significant risk to the integrity and confidentiality of the platform. Successful exploitation could lead to account takeover, unauthorized modification of store data, or the exfiltration of sensitive business information. With a CVSS score of 8.6, this high severity flaw necessitates immediate attention to prevent unauthorized administrative control.

Immediate Action: As no specific patch version is currently identified, organizations should contact the vendor support team for guidance or implement custom rate limiting on the vendor login endpoint.

Proactive Monitoring: Security teams should review web server logs for high volumes of failed login attempts originating from single IP addresses or abnormal patterns targeting the vendor login page.

Compensating Controls: Deploy a Web Application Firewall (WAF) to implement manual rate limiting and block suspicious traffic patterns directed at the authentication portal.

Public Exploit Available: Yes, a public proof-of-concept exists, attributed to the technical write-up provided by the researcher at the referenced GitHub repository.

Given the high CVSS score and the existence of a public proof-of-concept, this vulnerability represents a credible threat to CS-Cart installations. Administrators must prioritize the implementation of rate limiting or account lockout policies to mitigate the risk of brute-force attacks until an official vendor patch is released. Monitoring for anomalous login traffic is essential to identify and block ongoing attempts.