CVE-2014-4962

Name of the Vulnerable Software and Affected Versions Shopizer versions 1.1.5 and earlier

Description The issue allows remote attackers to manipulate the total cost of their shopping cart by entering a negative number in the productQuantity parameter. This causes the price of the item to be subtracted from the total cost, potentially allowing attackers to reduce their total cost.

Recommendations For Shopizer versions 1.1.5 and earlier, as a temporary workaround, consider restricting the use of the productQuantity parameter to positive numbers only until a fix is available.