CVE-2026-120249 | CVSS: 6.5 | 严重级别: MEDIUM
Thelia Back-office Default Twig Template before 1.1.1 contains a cross-site request forgery vulnerability in the /admin/product/combinations/update and /admin/product/default-price/update routes, which accept GET requests without anti-CSRF token checks. Attackers can lure a logged-in administrator into following a crafted link to rewrite product combination prices, stock, weight, EAN and sale flags, zeroing omitted prices.
参考链接:
• https://github.com/thelia-templates/default-twig/blob/6473c164bd86348f4c7d0ef6f1
• https://github.com/thelia-templates/default-twig/commit/51b014b06a5b4ee45f15093a
• https://github.com/thelia-templates/default-twig/commit/aaf540ca552dbc4c63dca776
📌 数据来源: NVD 官方
⚠️ 合规声明: 本文内容仅用于网络安全合规学习、科研与授权测试用途。严禁用于任何未授权行为,违者自行承担全部法律责任。