PatchSiren

PatchSiren cyber security CVE debrief

CVE-2025-13004 Farktor CVE debrief

CVE-2025-13004 is a MEDIUM-severity authorization bypass vulnerability in Farktor Software's E-Commerce Package, affecting versions through 2025-11-27. The flaw stems from CWE-639 (Authorization Bypass Through User-Controlled Key), enabling authenticated attackers with low privileges to manipulate user-controlled variables and potentially escalate privileges or access unauthorized resources. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:L) indicates network attack vector, low attack complexity, required low privileges and user interaction, with high impact to integrity and low availability impact. The vulnerability was published on 2026-02-12 and last modified on 2026-06-04. No known exploitation in ransomware campaigns has been documented, and the vulnerability is not listed in CISA KEV. Two Turkish cybersecurity authority advisories (TR-26-0063) provide third-party guidance.

Vendor
Farktor
Product
E-Commerce Package
CVSS
MEDIUM 6.3
CISA KEV
Not listed in stored evidence
Original CVE published
2026-02-12
Original CVE updated
2026-06-04
Advisory published
2026-02-12
Advisory updated
2026-06-04

Who should care

Organizations operating Farktor E-Commerce Package instances, particularly e-commerce platforms handling customer transactions and user privilege separation. Security teams in Turkish-speaking regions should prioritize review given local advisory publication.

Technical summary

The vulnerability exists in the authorization mechanism of Farktor Software's E-Commerce Package where user-controlled keys are improperly validated, allowing manipulation of user-controlled variables. An attacker with low-privilege network access can exploit this via user interaction to bypass authorization checks, resulting in high integrity impact. The affected CPE cpe:2.3:a:farktor:e-commerce_package:*:*:*:*:*:*:*:* covers all versions through 2025-11-27. No patch version is specified in available sources; organizations should verify current version against this cutoff date and apply subsequent vendor updates.

Defensive priority

medium

Recommended defensive actions

  • Verify Farktor E-Commerce Package version and confirm installation is not running version 2025-11-27 or earlier
  • Apply vendor patches or updates released after 2025-11-27 if available from Farktor Software
  • Review application authorization logic for user-controlled key parameters and implement server-side validation
  • Monitor access logs for anomalous privilege escalation attempts or unauthorized variable manipulation
  • Restrict administrative functions to least-privilege accounts and enforce multi-factor authentication where feasible
  • Consult USOM advisory TR-26-0063 for additional Turkish-language mitigation guidance

Evidence notes

CWE-639 classification and version range through 2025-11-27 confirmed via NVD CPE criteria. CVSS 3.1 vector and score derived from official NVD record. Advisory sources tagged as Third Party Advisory by USOM (Turkish National Cyber Incident Response Team).

Official resources

2026-02-12