Hariprasanth9317-Tech

OpenMage magento-lts before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 accepts the free (No Payment Information Required) payment method on orders with a non-zero total because the zero-total check runs only when payment data is imported. An API user with cart permissions can select free via cart payment.method while the total is zero, raise it with cart coupon.remove, and submit cart.order to place an unpaid full-price order.

Customer email-confirmation keys are generated using `md5(uniqid())`, while customer and administrator password-reset tokens use the non-cryptographic `uniqHash()` function. Unauthenticated attackers can brute-force the approximately 20-bit confirmation key through the `confirmAction` endpoint, which lacks rate limiting, to gain access as pending customers. Additionally, administrator reset tokens can be predicted after the generator state is recovered.

The PDF export feature allows for server-side request forgery (SSRF), a condition where the server is coerced into making requests to an unintended location. This occurs when the system fetches external images referenced in FAQ answers. An attacker capable of influencing FAQ content can embed image URLs pointing to loopback or internal services, leading the server to request these resources and embed the responses within the generated PDF files.