CVE-2024-45300 Bypassing promo code limitations with race conditions

What is CVE-2024-45300?

CVE-2024-45300 is a high-severity vulnerability in alfio-event alf.io, published on 6 Sep 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

alf.io is an open source ticket reservation system for conferences, trade shows, workshops, and meetups. Prior to version 2.0-M5, a race condition allows the user to bypass the limit on the number of promo codes and use the discount coupon multiple times. In "alf.io", an event organizer can apply price discounts by using promo codes to your events. The organizer can limit the number of promo codes that will be used for this, but the time-gap between checking the number of codes and restricting the use of the codes allows a threat actor to bypass the promo code limit. Version 2.0-M5 fixes this issue.

Weakness: CWE-362

Which versions are affected by CVE-2024-45300?

It affects 1 product.

Products include Alf Alf.

How do I fix CVE-2024-45300?

No fix has been published for CVE-2024-45300 yet. Limit exposure of the affected software until one is available.

Is CVE-2024-45300 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-45300 exists.

Other vulnerabilities in alfio-event alf.io

• CVE-2023-2259 Improper Neutralization of Special Elements Used in a Template Engine in alfio-event/alf.io Critical 9.1
• CVE-2024-25635 IDOR Vulnerability: Allowing Organization Owner to view the other Organizations API KEY and USERS High 8.8
• CVE-2023-2258 Improper Neutralization of Formula Elements in a CSV File in alfio-event/alf.io High 8.8
• CVE-2023-2260 Authorization Bypass Through User-Controlled Key in alfio-event/alf.io High 8.8
• CVE-2026-35482 alf.io has an Authenticated RCE via Extension Script Sandbox Escape High 8.0

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-67jg-m6f3-473g.