Description:
The ShipStation plugin for CS-Cart version v1.0.10 and earlier allows remote attackers to insert arbitrary information into the database (via action=shipnotify) because access to this endpoint is completely unchecked.
Additional information: