CVE-2025-15116
Race Condition in OpenCart Single-Use Coupon Handler Allows Remote Attack
Publication date: 2025-12-28
Last updated on: 2026-04-29
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| opencart | opencart | 4.1.0.3 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-362 | The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a security flaw in OpenCart up to version 4.1.0.3, specifically in the Single-Use Coupon Handler component. It involves a race condition that can be triggered remotely. The attack is complex and difficult to exploit, but a public exploit has been released.
How can this vulnerability impact me? :
The vulnerability can impact you by allowing an attacker to manipulate the Single-Use Coupon Handler through a race condition, potentially leading to unauthorized actions or misuse of coupons. However, it does not affect confidentiality or availability, only integrity to a limited extent.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by monitoring for concurrent checkout requests that apply single-use coupons multiple times or cause inventory stock to go negative. Detection involves observing unusual patterns such as multiple orders using the same single-use coupon or negative inventory values. A practical approach is to simulate concurrent checkout requests using a script similar to the provided proof-of-concept Python script that sends multiple simultaneous guest checkout requests applying the coupon and placing orders. Specific commands would involve running such a multi-threaded script to test if the system improperly allows multiple uses of a single-use coupon or oversells inventory. However, no direct detection commands are provided in the resources. [2]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include implementing database locking mechanisms such as pessimistic locking (e.g., using `SELECT ... FOR UPDATE`) on coupon and product rows during checkout validation to ensure atomicity and prevent concurrent modifications. Additionally, enforcing database-level constraints like unsigned integers for stock quantities can prevent negative inventory values by rejecting invalid updates. Since no patches or official fixes are available, replacing or upgrading the affected component or product may be necessary. Monitoring for suspicious concurrent checkout activity and temporarily disabling single-use coupons until a fix is applied could also help reduce risk. [1, 2]