Remote Code Execution Vulnerability in Shopizer Webshop by Shopizer
CVE-2014-4962

Currently unrated

Key Information:

Vendor

Shopizer

Status
Shopizer
Vendor
CVE Published:
15 July 2014

What is CVE-2014-4962?

An input validation issue in versions of the Shopizer webshop prior to 1.1.5 allows remote attackers to manipulate the shopping cart total. By entering a negative number in the productQuantity parameter, attackers can cause the system to deduct the item's price from the cart total, resulting in unauthorized discounts. This vulnerability highlights the importance of robust input validation in e-commerce platforms to protect against financial exploitation.

References

http://www.securityfocus.com/archive/1/532726/100/0/threaded
mailing-listx_refsource_BUGTRAQ
http://seclists.org/fulldisclosure/2014/Jul/38
mailing-listx_refsource_FULLDISC

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.