CVE-2025-7954: Shopware race condition bypasses voucher restrictions

The vulnerability exists in the PromotionRedemptionUpdater.php file, specifically in the orderPlaced method. This method was responsible for updating the redemption count of a promotion. The vulnerability is a classic race condition where the application reads the current count, increments it, and writes it back to the database without any locking mechanism. This allows multiple requests to read the same value before it's updated, leading to an incorrect final count and allowing the voucher to be used more times than intended.

The patch addresses this by changing the event from CheckoutOrderPlacedEvent to OrderEvents::ORDER_WRITTEN_EVENT and renaming the function to orderUpdated. More importantly, the logic was changed to fetch the total count of the promotion from the order_line_item table and update the order_count with this value. This ensures that the update is atomic and based on the actual state of the database, thus preventing the race condition.