PT-2019-15534 · Cezerin · Cezerin

Published 2019-10-29 · Updated 2022-05-24 · CVE-2019-18608

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Cezerin version 0.33.0

Description The issue allows unauthorized modification of order information because internal attributes can be overwritten via conflicting names when processing order requests. A malicious customer can manipulate an order, such as its payment status or shipping fee, by adding additional attributes to user-input during the PUT "/ajax/cart" operation for a checkout. This is due to the getValidDocumentForUpdate function in api/server/services/orders/orders.js.

Recommendations For Cezerin version 0.33.0, as a temporary workaround, consider restricting access to the getValidDocumentForUpdate function in api/server/services/orders/orders.js until a patch is available. Avoid using the PUT "/ajax/cart" operation for checkout without proper validation of user-input attributes. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2019-18608

GHSA-6PQ6-CRW9-522H

Affected Products

Cezerin

References · 5

• 🔥 https://github.com/cl0udz/vulnerabilities/blob/master/cezerin-manipulate_order_information/README.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-18608 · Security Note
• https://osv.dev/vulnerability/GHSA-6pq6-crw9-522h · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-18608 · Vendor Advisory
• https://github.com/cezerin/cezerin · Note