Miggo Logo
Miggo Vulnerability Database
→
CVE-2020-11007

CVE-2020-11007: Negative charge in shopping cart in Shopizer

6.5

CVSS Score
3.1

Basic Information

CVE ID
CVE-2020-11007
GHSA ID
GHSA-w8rc-pgxq-x2cj
EPSS Score
0.42879%
CWE
CWE-20
Published
4/22/2020
Updated
1/9/2023
KEV Status
No
Technology
TechnologyJava

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Package NameEcosystemVulnerable VersionsFirst Patched Version
com.shopizer:sm-core-modelmaven< 2.11.02.11.0

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The commit diff shows critical validation checks for quantity <1 were added in two methods: 1) addItemsToShoppingCart (line 111) and 2) addToCart with Customer parameter (line 917). These functions previously accepted negative quantities without validation, enabling cart/order total manipulation. The direct correlation between the vulnerability description (negative quantity impact) and these patched methods indicates they were the vulnerable entry points.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

### Imp**t Usin* *PI or *ontroll*r **s** v*rsions n***tiv* qu*ntity is not ***qu*t*ly v*li**t** **n** *r**tin* in*orr**t s*oppin* **rt *n* or**r tot*l. ### P*t***s ***in* * ***k-*n* v*ri*i**tion to ****k t**t qu*ntity p*r*m*t*r isn't n***tiv*. I* s

Reasoning

T** *ommit *i** s*ows *riti**l v*li**tion ****ks *or qu*ntity <* w*r* ***** in two m*t*o*s: *) `***It*msToS*oppin***rt` (lin* ***) *n* *) `***To**rt` wit* *ustom*r p*r*m*t*r (lin* ***). T**s* *un*tions pr*viously ****pt** n***tiv* qu*ntiti*s wit*out