Description
Bagisto before 2.3.16 and 2.4.x before 2.4.1 contains a race condition vulnerability in manageCartRule() that allows attackers to redeem single-use coupons multiple times. Attackers can submit concurrent order requests to the onepage orders checkout endpoint, bypassing unlocked times_used checks to apply discounts repeatedly.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| bagisto | bagisto | < 2.3.16, 2.4.0 – < 2.4.1 | 2.3.16 |
References
- https://github.com/bagisto/bagisto/commit/81cb2a2a35b355492f704fd216d679f2145a5650 patch
- Patch Commit patch
- bagisto v2.3.16 Release Notes release-notes
- bagisto v2.4.1 Release Notes release-notes
- https://gist.github.com/Ayxpp/5358d9fff045e94e0ddb51677ed5d195 exploit
- https://github.com/bagisto/bagisto/blob/v2.4.0/packages/Webkul/CartRule/src/Listeners/Order.php#L30-L95 technical-description
- https://github.com/bagisto/bagisto product
- VulnCheck Advisory: Bagisto before 2.3.16 and 2.4.x before 2.4.1 Race Condition in Coupon Usage Accounting third-party-advisory