CVE-2024-46307 Business logic in n/a
Attackers can arbitrarily modify product quantities in Sparkshop due to a flaw in the payment logic, leading to unauthorized data modification.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-46307?
CVE-2024-46307 is a high-severity vulnerability in n/a, published on 9 Oct 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A loop hole in the payment logic of Sparkshop v1.16 allows attackers to arbitrarily modify the number of products.
Weakness: CWE-841
Which versions are affected by CVE-2024-46307?
It affects 1 product.
Products include Sparkshop Sparkshop.
How do I fix CVE-2024-46307?
No fix has been published for CVE-2024-46307 yet. Limit exposure of the affected software until one is available.
Is CVE-2024-46307 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-46307 exists.
Other vulnerabilities in n/a
Sources
Also known as GHSA-3j3r-8qhc-763h.