Описание
Shopper: Negative discount values accepted and propagated through order calculation pipeline
Summary
The Shopper Framework discount management functionality accepts negative discount values without server-side validation.
It was confirmed that negative fixed-amount discounts can be created through the administrative interface, persisted to the database, and subsequently processed by the cart/order calculation pipeline.
The application appears to assume that discount values are always positive but does not enforce this assumption during creation, storage, or calculation.
As a result, malformed discount records can influence financial calculations and produce unintended order totals.
Affected Product
Package: shopper/framework
Version Tested: 2.8.1
Vulnerability Type
- Business Logic Vulnerability
- Improper Input Validation (CWE-20)
Description
While reviewing the discount functionality, it was discovered that the application accepts negative discount values through the administrative interface.
Example values tested:
The application accepted these values without validation and stored them in the database.
Example records observed in the sh_discounts table:
This demonstrates that negative discount values are successfully persisted.
Steps to Reproduce
1. Create a Discount
Login as an administrator.
Navigate to:
Create a new discount with the following values:
Save the discount.
2. Observe Successful Creation
The discount is accepted by the application and displayed in the administration interface.
Example:
3. Verify Database Persistence
Inspect the database:
Observed entry:
Technical Analysis
Discount Calculation
File:
Observed code:
The value is later processed without validation:
When a negative value is supplied:
returns:
allowing the negative value to continue through the calculation pipeline.
The resulting adjustment values are inserted into the database:
No validation was identified to ensure that discount amounts are positive before calculations occur.
Final Total Calculation
File:
Observed logic:
Because negative discount values are allowed to reach this stage, financial calculations are performed using malformed discount data.
Example:
Resulting calculation:
Result:
This demonstrates that negative discount values directly affect order total calculations.
Impact
The following was confirmed:
- Negative discount values are accepted.
- Negative discount values are persisted.
- Negative discount values are processed by the discount calculation engine.
- Negative discount values affect order total calculations.
Potential consequences include:
- Incorrect pricing calculations.
- Financial data integrity issues.
- Unexpected order totals.
- Violated assumptions within downstream pricing logic.
- Future vulnerabilities if additional components assume discount values are always positive.
Because Shopper is a headless e-commerce administration framework and does not ship with a customer-facing storefront, it was not verified a customer-facing exploitation path.
However, malformed discount records currently propagate through pricing calculations without validation.
Recommendation
Implement server-side validation enforcing positive discount values before persistence and before entering the calculation pipeline.
Suggested validation:
Fixed Amount Discounts
Percentage Discounts
Additionally, existing discount records should be validated before calculation to prevent malformed data from influencing pricing logic.
Environment
Пакеты
shopper/framework
< 2.9.0
2.9.0
Связанные уязвимости
Shopper is a Headless e-commerce Admin Panel. Prior to 2.9.0, the /cpanel/discounts administrative interface accepts negative fixed_amount discount values, persists them in sh_discounts, and passes them through vendor/shopper/cart/src/Discounts/DiscountCalculator.php and vendor/shopper/cart/src/Pipelines/Calculate.php without enforcing a positive-value invariant. Because the calculation subtracts discountTotal from the subtotal, a negative discount increases the resulting order total instead of reducing it. Malformed discount records can therefore cause incorrect pricing and financial data integrity failures, although the advisory does not establish a customer-facing exploitation path. This issue is fixed in version 2.9.0.