NopCommerce 4.90.0: CSRF Vulnerability Turns Scheduled Tasks Into Sneaky Saboteurs!
nopCommerce 4.90.0’s Schedule Tasks feature has a CSRF vulnerability, allowing attackers to run tasks without user consent. Talk about scheduling a surprise party without the guest of honor! This flaw has its own CVE code: CVE-2025-65593. Time to patch up before your tasks become someone else’s to-do list!
Hot Take:
Ah, CSRF vulnerabilities: the uninvited guests that just keep crashing the party! This time, they’ve RSVP’d to the nopCommerce 4.90.0 bash, sneaking in through the Schedule Tasks functionality. It’s like what happens when you leave your front door open while you’re busy binge-watching a cybersecurity documentary—something is bound to go wrong, and you might end up with a hacker running your chores! The moral of the story: always lock your digital doors, folks.
Key Points:
- nopCommerce 4.90.0 has a Cross-Site Request Forgery (CSRF) vulnerability.
- The issue is found in the “Run now” button of the Schedule Tasks functionality.
- An attacker can execute tasks without the victim’s consent or knowledge.
- This vulnerability has been assigned the CVE code: CVE-2025-65593.
- Discovered by AlterSec trading as PenTest.NZ.