CVE-2025-61546
BaseFortify
Publication date: 2026-01-08
Last updated on: 2026-02-10
Assigner: MITRE
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| edu_business_solutions | print_shop_pro_webdesk | 18.34 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-20 | The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the /PSP/appNET/Store/CartV12.aspx/GetUnitPrice endpoint of edu Business Solutions Print Shop Pro WebDesk version 18.34. It allows a remote attacker to create financial discrepancies by purchasing items with a negative quantity. The root cause is that the system relies on client-side input validation controls, which can be bypassed by an attacker.
How can this vulnerability impact me? :
The vulnerability can lead to financial discrepancies, potentially allowing attackers to manipulate purchase transactions by ordering items with negative quantities. This could result in incorrect billing, financial loss, or accounting errors for the affected organization.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, you should implement server-side validation to ensure that negative quantities cannot be submitted or processed. Additionally, review and update the /PSP/appNET/Store/CartV12.aspx/GetUnitPrice endpoint to reject or sanitize client inputs that attempt to specify negative quantities. Until a patch is available, consider restricting access to this endpoint or monitoring for suspicious activity involving negative quantity purchases.