Negative Discount Bypass in Shopper Admin Panel

Executive Summary

This vulnerability in Shopper, a Headless e-commerce Admin Panel, allows negative fixed-amount discount values to be accepted and processed. Instead of reducing order totals, these negative discounts inflate them because the calculation subtracts the discount from the subtotal. For example, a $10,000 subtotal with a -$5,000 discount results in a $15,000 total. The issue stems from a lack of input validation in discount creation, storage, and calculation stages.

Useful 0 Not Useful 0

Detection Guidance

Check for negative or zero discount values in the sh_discounts table using SQL queries like: SELECT * FROM sh_discounts WHERE fixed_amount <= 0 OR percentage <= 0. Review admin interface forms for discount inputs to ensure they allow invalid values. Inspect cart calculation logic in vendor/shopper/cart/src/Discounts/DiscountCalculator.php and vendor/shopper/cart/src/Pipelines/Calculate.php for improper handling of negative discounts.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to incorrect financial calculations, inflating order totals instead of reducing them. It may cause financial data integrity failures, such as overcharging customers or misreporting revenue. An attacker with administrative access could exploit this to manipulate pricing, though no direct customer-facing exploitation path has been confirmed.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade to Shopper version 2.9.0 or later to apply the fix. If upgrading is not immediately possible, implement server-side validation to reject negative or zero discount values and percentages above 100. Add a DiscountObserver to validate values during database writes and a DiscountValidator to check values during cart calculations.

Useful 0 Not Useful 0