CyberRota Analysis
AI-GeneratedThe Shopper Headless e-commerce Admin Panel prior to version 2.9.0 is vulnerable due to its /cpanel/discounts interface allowing negative fixed_amount discount values, which can lead to inflated order totals and compromised financial data integrity. While there is no direct customer-facing exploitation path, the potential for incorrect pricing necessitates immediate attention from e-commerce platforms and administrators using affected versions. Organizations should prioritize upgrading to version 2.9.0 to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Shopper is a Headless e-commerce Admin Panel. Prior to 2.9.0, the /cpanel/discounts administrative interface accepts negative fixed_amount discount values, persists them in sh_discounts, and passes them through vendor/shopper/cart/src/Discounts/DiscountCalculator.php and vendor/shopper/cart/src/Pipelines/Calculate.php without enforcing a positive-value invariant. Because the calculation subtracts discountTotal from the subtotal, a negative discount increases the resulting order total instead of reducing it. Malformed discount records can therefore cause incorrect pricing and financial data integrity failures, although the advisory does not establish a customer-facing exploitation path. This issue is fixed in version 2.9.0.