Executive Summary

This vulnerability exists in the /PSP/appNET/Store/CartV12.aspx/GetUnitPrice endpoint of edu Business Solutions Print Shop Pro WebDesk version 18.34. It allows a remote attacker to create financial discrepancies by purchasing items with a negative quantity. The root cause is that the system relies on client-side input validation controls, which can be bypassed by an attacker.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability can lead to financial discrepancies, potentially allowing attackers to manipulate purchase transactions by ordering items with negative quantities. This could result in incorrect billing, financial loss, or accounting errors for the affected organization.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, you should implement server-side validation to ensure that negative quantities cannot be submitted or processed. Additionally, review and update the /PSP/appNET/Store/CartV12.aspx/GetUnitPrice endpoint to reject or sanitize client inputs that attempt to specify negative quantities. Until a patch is available, consider restricting access to this endpoint or monitoring for suspicious activity involving negative quantity purchases.

Useful 0 Not Useful 0