PT-2026-56032 · Unknown · Fossbilling
CVSS v4.0
2.3
Low
| Vector | AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Name of the Vulnerable Software and Affected Versions
FOSSBilling versions prior to 0.8.0
Description
The PayPalEmail payment adapter fails to validate the amount supplied via PayPal IPN (Instant Payment Notification) callbacks, specifically the
mc gross variable, against the actual invoice total. Due to a $0.05 floating-point epsilon tolerance—a small margin of error used in computer calculations to account for precision limits—in the invoice credit-payment logic, a client can underpay an invoice by up to $0.04 and still have the system mark it as fully paid.Recommendations
Update to version 0.8.0.
Monitor IPN transactions for amounts that do not match corresponding invoice totals and manually review or refund suspicious payments.
Exploit
Fix
Improper Check for Exceptional Conditions
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Fossbilling