| शीर्षक | newbee-ltd newbee-mall a069069b07027613bf0e7f571736be86f431faee Improper Validation of Specified Quantity in Input |
|---|
| विवरण | newbee-ltd newbee-mall contains an improper validation of specified quantity vulnerability in the shopping cart and order-processing logic. An authenticated member can submit a negative goodsCount value through the shopping cart add or update functionality because the server enforces only an upper quantity limit and does not verify that the quantity is positive. The negative value is stored and later used directly when calculating the order total and updating product stock. As a result, a negative cart line can offset the price of legitimate positive-quantity items, reducing the persisted order total, while the stock update calculation increases the affected product's stock instead of decreasing it. In the verified proof of concept, an order containing a positive line worth 500 and a negative line worth -415 was persisted with a total price of 85, and the targeted product stock increased from 998 to 1003. The issue was reproduced at commit a069069b07027613bf0e7f571736be86f431faee.
The issue has been reported to the upstream maintainers via GitHub Issue; no maintainer response has been received to date. |
|---|
| स्रोत | ⚠️ https://github.com/newbee-ltd/newbee-mall/issues/127 |
|---|
| उपयोगकर्ता | cztang (UID 101252) |
|---|
| सबमिशन | 18/09/2026 04:01 AM (18 दिन पहले) |
|---|
| संयम | 05/10/2026 06:11 PM (18 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 413632 [newbee-ltd newbee-mall तक 2.7.5 Shopping Cart Quantity updateAccountHeadAndDetail goodsCount] |
|---|
| अंक | 20 |
|---|