CVE-2024-50968 Business logic in n/a

High 7.5 Published 14 Nov 2024 Updated 20 Nov 2024

Attackers can manipulate cart quantity to zero out total price, allowing free purchases in the Agri-Trading Online Shopping System.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2024-50968?

CVE-2024-50968 is a high-severity vulnerability in n/a, published on 14 Nov 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

A business logic vulnerability exists in the Add to Cart function of itsourcecode Agri-Trading Online Shopping System 1.0, which allows remote attackers to manipulate the quant parameter when adding a product to the cart. By setting the quantity value to -0, an attacker can exploit a flaw in the application's total price calculation logic. This vulnerability causes the total price to be reduced to zero, allowing the attacker to add items to the cart and proceed to checkout.

Which versions are affected by CVE-2024-50968?

It affects 1 product.

Products include Adonesevangelista Agri-Trading Online Shopping System.

How do I fix CVE-2024-50968?

No fix has been published for CVE-2024-50968 yet. Limit exposure of the affected software until one is available.

Is CVE-2024-50968 being exploited?

There is no known exploitation of CVE-2024-50968 in the wild and no public exploit code.

Public exploit code: 1 proofs of concept on GitHub.

Sources

Also known as GHSA-q3wq-j7qf-v6g7.