Quick.Cart version 6.7 is vulnerable to Cross-Site Request Forgery (CSRF) attacks in its product creation functionality. An attacker can craft a malicious website that, when visited by an admin user, causes an unauthorized product to be created with attacker-defined content. The software lacks any CSRF protections on its forms, making all forms potentially vulnerable. The vendor has not provided details on affected version ranges or remediation.