Business Logic Error in NewBee-Mall Shopping Cart

Executive Summary

This vulnerability affects the newbee-mall e-commerce platform up to version 2.7.5. It involves a flaw in the shopping cart quantity handler where an authenticated user can manipulate the goodsCount argument to cause business logic errors. The issue allows negative cart quantities to be stored, which can corrupt order totals and inventory data when orders are processed.

Useful 0 Not Useful 0

Detection Guidance

Check for negative cart quantities in order submissions or database entries. Monitor for unusual stock increases after orders. Review application logs for requests to /jshERP-boot/accountHead/updateAccountHeadAndDetail with negative goodsCount values.

Useful 0 Not Useful 0

Impact Analysis

An attacker with a valid member account can exploit this to reduce order totals by using negative quantities, inflate product stock counters, and corrupt inventory data. For example, an order with a positive line of 500 and a negative line of -415 could result in a total of 85 while increasing the targeted product's stock from 998 to 1003. This can lead to financial losses and operational disruptions.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could impact compliance with GDPR and HIPAA by enabling unauthorized data manipulation. Negative cart quantities could alter order totals and inflate stock counters, leading to inaccurate financial records. For GDPR, this may affect data integrity requirements under Article 5. For HIPAA, it could compromise accurate inventory tracking in healthcare-related e-commerce systems.

Useful 0 Not Useful 0

Mitigation Strategies

Validate cart quantities to ensure they are positive integers during cart addition and order submission. Add database constraints to enforce positive stock values. Restrict negative values in the /jshERP-boot/accountHead/updateAccountHeadAndDetail endpoint.

Useful 0 Not Useful 0