Improper Quantity Validation in Webkul Bagisto

Executive Summary

This vulnerability in Bagisto v2.4.9 allows authenticated users to manipulate the cart total by submitting negative quantities during the add-to-cart process. The system fails to validate the quantity parameter for positivity, enabling attackers to reduce their order total below the legitimate price of goods. The issue stems from improper handling in methods like handleQuantity() and lack of validation in endpoints such as wishlist move-to-cart and bundle option quantity paths.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, monitor API requests to the Bagisto endpoints for negative quantity parameters. Check logs for POST requests to /api/customer/wishlist/{id}/move-to-cart or /api/checkout/cart with negative values in quantity or bundle_option_qty fields. Review cart totals for negative values before checkout.

• Inspect database records for non-positive quantities or negative order totals, especially in bundle orders.

Useful 0 Not Useful 0

Impact Analysis

An attacker can exploit this to drastically reduce their cart total before checkout. For example, adding a high-value item and then using negative quantities on another item to lower the overall payment amount. The merchant may ship real goods while receiving a manipulated, lower payment, resulting in financial loss. The database clamps negative quantities to zero but the negative total persists.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to financial loss for merchants by allowing attackers to manipulate order totals, potentially violating financial transaction integrity requirements under regulations like GDPR (data protection) and HIPAA (if payment data is involved).

Useful 0 Not Useful 0

Mitigation Strategies

Implement input validation to enforce positive quantities in the handleQuantity() method and endpoints. Add server-side checks for quantity parameters in wishlist and bundle option paths. Ensure database constraints prevent negative values from affecting totals.

• Audit existing cart and order data for negative quantities or totals and correct them immediately.

Useful 0 Not Useful 0