PT-2025-11485 · Sylius · Syliud Paypal Plugin

Published 2025-03-17 · Updated 2025-03-17 · CVE-2025-29788

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Syliud PayPal Plugin versions prior to 1.6.1, 1.7.1, and 2.0.1

Description A vulnerability in the Syliud PayPal Plugin allows users to manipulate the final payment amount processed by PayPal. If a user modifies the item quantity in their shopping cart after initiating the PayPal Express Checkout process, PayPal will not receive the updated total amount. As a result, PayPal captures only the initially transmitted amount, while Sylius incorrectly considers the order fully paid based on the modified total. This flaw can be exploited both accidentally and intentionally, potentially enabling fraud by allowing customers to pay less than the actual order value. Attackers can intentionally pay less than the actual total order amount, business owners may suffer financial losses due to underpaid orders, and integrity of payment processing is compromised.

Recommendations To resolve the problem, update to versions 1.6.1, 1.7.1, 2.0.1, or above. As a temporary workaround, consider overwriting ProcessPayPalOrderAction, CompletePayPalOrderFromPaymentPageAction, and CaptureAction with modified logic to verify the payment amount. Register the modified services in the container according to the provided YAML configuration for PayPal 1.x or 2.x.

Exploit

Fix

Weakness Enumeration

CWE-472

Related Identifiers

CVE-2025-29788

GHSA-PQQ3-Q84H-PJ6X

Affected Products

Syliud Paypal Plugin

References · 13

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/29xxx/CVE-2025-29788.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-29788 · Security Note
• https://osv.dev/vulnerability/GHSA-pqq3-q84h-pj6x · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-29788 · Vendor Advisory
• https://github.com/Sylius/PayPalPlugin/commit/8a81258f965b7860d4bccb52942e4c5b53e6774d · Note
• https://github.com/Sylius/PayPalPlugin/releases/tag/v2.0.1 · Note
• https://github.com/Sylius/PayPalPlugin/security/advisories/GHSA-pqq3-q84h-pj6x · Note
• https://github.com/Sylius/PayPalPlugin/releases/tag/v1.6.1 · Note
• https://github.com/Sylius/PayPalPlugin/releases/tag/v1.7.1 · Note
• https://github.com/Sylius/PayPalPlugin/commit/31e71b0457e5d887a6c19f8cfabb8b16125ec406 · Note
• https://github.com/Sylius/PayPalPlugin · Note
• https://t.me/cvedetector/20482 · Telegram Post
• https://t.me/cvetracker/19284 · Telegram Post