This vulnerability is a CWE-352 Cross-Site Request Forgery issue in the T-Soft E-Commerce product by Tekrom Technology Inc. It allows attackers to induce authenticated users to perform unwanted actions without their consent. The CVSS 3.1 vector indicates the attack can be performed remotely without privileges, requires user interaction, and impacts confidentiality and integrity to a limited extent, but does not affect availability. The affected versions include all up to 28112025. No patch or remediation details are provided in the available data.

An attacker could exploit this CSRF vulnerability to cause authenticated users to perform unintended actions on the T-Soft E-Commerce platform. The impact is limited to partial confidentiality and integrity loss, with no availability impact. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider implementing standard CSRF mitigations such as verifying anti-CSRF tokens and enforcing same-site cookie attributes if possible within their deployment environment.