CVE-2024-50968

Nov. 20, 2024, 5:35 p.m.

7.5
High

Description

A business logic vulnerability exists in the Add to Cart function of itsourcecode Agri-Trading Online Shopping System 1.0, which allows remote attackers to manipulate the quant parameter when adding a product to the cart. By setting the quantity value to -0, an attacker can exploit a flaw in the application's total price calculation logic. This vulnerability causes the total price to be reduced to zero, allowing the attacker to add items to the cart and proceed to checkout.

Product(s) Impacted

Vendor Product Versions
Adonesevangelista
  • Agri-trading Online Shopping System
  • 1.0

Weaknesses

Common security weaknesses mapped to this vulnerability.

*CPE(s)

Affected systems and software identified for this CVE.

Type Vendor Product Version Update Edition Language Software Edition Target Software Target Hardware Other Information
a adonesevangelista agri-trading_online_shopping_system 1.0 / / / / / / /

References

https://github.com/Akhlak2511/CVE-2024-50968

Tags

cve@mitre.org
NVD-CWE-noinfo
2024-11-14
CVE-2024-50968

CVSS Score

7.5 / 10

CVSS Data - 3.1

  • Attack Vector: NETWORK
  • Attack Complexity: LOW
  • Privileges Required: NONE
  • Scope: UNCHANGED
  • Confidentiality Impact: NONE
  • Integrity Impact: HIGH
  • Availability Impact: NONE

    • CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

    View Vector String

Timeline

Published: Nov. 14, 2024, 10:15 p.m.
Last Modified: Nov. 20, 2024, 5:35 p.m.

Status : Modified

CVE has been recently published to the CVE List and has been received by the NVD.

More info

Source

cve@mitre.org

*Disclaimer: Some vulnerabilities do not have an associated CPE. To enhance the data, we use AI to infer CPEs based on CVE details. This is an automated process and might not always be accurate.