Web Security Insights By Maloy Roy Orko

Hi All,  I am Maloy Roy Orko Recently in one of my pentest research, I found a E-commerce System By Script And Tools which is an open source E-commerce Software. Curious to explore its functionalities, I downloaded and set it up in my local system.  After fiddling with the source code, I found that the /admin/order-delete.php file is vulnerable to Cross-Site Request Forgery (CSRF)  It can lead into: Unauthorized Actions    Data Manipulation Account Takeover   Financial Loss Compliance Violations   Increased Attack Surface  The Main Thing Is,If any NON-IT personal uses this template,he will fall into this vulnerability and his companies reputation can be lost too. Thats why, I am trying to inform everyone about this. Title of the Vulnerability:  Script and Tools | eCommerce 3.0 | admin/order-delete.php - CSRF Vulnerability Class : Cross-Site Request Forgery (CSRF) Product Name : eCommerce 3.0  Vendor : https:/github.com/scriptan...