| ID | Project | Category | View Status | Date Submitted | Last Update |
|---|---|---|---|---|---|
| 0007994 | OXID eShop (all versions) | 1.03. Basket, checkout process | public | 2026-08-19 15:11 | 2026-08-19 15:11 |
| Reporter | suabo | Assigned To | |||
| Priority | normal | Severity | minor | Reproducibility | always |
| Status | new | Resolution | open | ||
| Product Version | 6.5.4 | ||||
| Summary | 0007994: Business Logic & Input Validation Vulnerability in Cart System | ||||
| Description | Vulnerable Component: Shopping Cart Handler (tobasket) Vulnerable Parameter: am (Quantity Input Field) Vector: Remote HTTP POST Data Manipulation 1. Description The shopping cart system lacks proper server-side input length and data-type validation for the am parameter. An attacker can manipulate the request body by injecting an excessively large integer value (e.g., $10^{100}+$). The backend processes this payload without proper bounds-checking, resulting in an uncontrolled mathematical overflow and corruption of the total cart balance calculation. 2. Business & Security Impact - Memory & Database Risk: Unvalidated large data entries passed to backend databases or ERP systems can trigger schema errors, data truncation, or unexpected system exceptions. - Integrity Failure in Core Logic: Allowing corrupted/overflowed totals bypasses the mathematical integrity of the pricing engine. - Potential DoS on Checkout Processing: Processing these extreme values during downstream checkout steps can lead to application crashes or unhandled exceptions. | ||||
| Steps To Reproduce | Select any product and intercept the HTTP POST request sent to /tobasket. Modify the payload parameter am to an oversized integer value: HTTP Content-Disposition: form-data; name="am" 999999999999999999999999999999999999999999999999999999999999999999999999999999999999999... The server responds with 302 Found and reflects the unvalidated value directly into the cart total calculation. (Please refer to the attached screenshots showing both the Burp HTTP request and the resulting cart state) | ||||
| Additional Information | Remediation Recommendation - Strict Bounds Checking: Enforce server-side validation to restrict the am parameter to a realistic integer range (e.g., 1 to 99). - Input Sanitization & Casting: Ensure inputs are explicitly cast to bounded integer types before processing calculations. We received this vulnerability report from someone [email protected] | ||||
| Tags | No tags attached. | ||||
| Theme | Not defined | ||||
| Browser | Not defined | ||||
| PHP Version | Not defined | ||||
| Database Version | Not defined | ||||
- Anonymous
