| 标题 | GrandNode grandnode2 2.3.0 Cross Site Scripting |
|---|
| 描述 | A race condition vulnerability was discovered in the gift voucher redemption process of grandnode/grandnode2. The flaw allows multiple distinct users or guests to redeem the same voucher concurrently via /checkout/ConfirmOrder/ endpoint. This can enable attackers with guest sessions or multiple accounts to redeem a single voucher multiple times across different guest sessions/accounts, potentially resulting in unauthorized financial gain. The vendor has been contacted privately without any responses. |
|---|
| 用户 | kkc73 (UID 89422) |
|---|
| 提交 | 2025-08-24 08時37分 (1 年前) |
|---|
| 管理 | 2025-09-10 12時48分 (17 days later) |
|---|
| 状态 | 已接受 |
|---|
| VulDB条目 | 323485 [GrandNode 直到 2.3.0 Voucher /checkout/ConfirmOrder/ giftvouchercouponcode 竞争条件] |
|---|
| 积分 | 17 |
|---|