CVE-2024-53476 Race condition in n/a
Attackers can bypass inventory limits via race conditions, causing overselling and unfulfilled orders in SimplCommerce.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-53476?
CVE-2024-53476 is a medium-severity vulnerability in n/a, published on 27 Dec 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A race condition vulnerability in SimplCommerce at commit 230310c8d7a0408569b292c5a805c459d47a1d8f allows attackers to bypass inventory restrictions by simultaneously submitting purchase requests from multiple accounts for the same product. This can lead to overselling when stock is limited, as the system fails to accurately track inventory under high concurrency, resulting in potential loss and unfulfilled orders.
Weakness: CWE-362
Which versions are affected by CVE-2024-53476?
How do I fix CVE-2024-53476?
No fix has been published for CVE-2024-53476 yet. Limit exposure of the affected software until one is available.
Is CVE-2024-53476 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-53476 exists.
Public exploit code: 1 proofs of concept on GitHub.
Sources
Also known as GHSA-jphx-whwm-8gpv.