PT-2026-82428 · Unknown · Storegrowth
CVSS v3.1
7.5
High
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N |
Name of the Vulnerable Software and Affected Versions
StoreGrowth versions prior to 2.1.2
Description
Insufficient validation of browser-supplied product prices on two unauthenticated actions allows unauthenticated attackers to add products to the cart at an arbitrary price. This manipulation affects the checkout total when the BOGO (Buy One Get One) offer feature is enabled.
Recommendations
Update StoreGrowth to version 2.1.2 or later.
Disable the BOGO offer feature as a temporary mitigation measure.
Exploit
Fix
Missing Authorization
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Storegrowth