waimai Super Cms 20150505 has a logic flaw allowing attackers to modify a price, before form submission, by observing data in a packet capture. By setting the index.php?m=gift&a=addsave credit parameter to -1, the product is sold for free.
References
| Link | Resource |
|---|---|
| https://github.com/caokang/waimai/issues/15 | Exploit Third Party Advisory |
| https://github.com/caokang/waimai/issues/15 | Exploit Third Party Advisory |
Configurations
History
21 Nov 2024, 05:12
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://github.com/caokang/waimai/issues/15 - Exploit, Third Party Advisory |
14 Oct 2021, 12:38
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:waimai_super_cms_project:waimai_super_cms:20150505:*:*:*:*:*:*:* | |
| CVSS |
v2 : v3 : |
v2 : 5.0
v3 : 7.5 |
| CWE | CWE-668 | |
| References | (MISC) https://github.com/caokang/waimai/issues/15 - Exploit, Third Party Advisory |
05 Oct 2021, 22:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2021-10-05 22:15
Updated : 2024-11-21 05:12
NVD link : CVE-2020-21503
Mitre link : CVE-2020-21503
CVE.ORG link : CVE-2020-21503
JSON object : View
Products Affected
waimai_super_cms_project
- waimai_super_cms
CWE
CWE-668
Exposure of Resource to Wrong Sphere