Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-115450— Price manipulation in the Ecommerce Template checkout flow through a client supplied Stripe price identifier

Quick assessment

Affected
MarcosCamara01 Ecommerce Template
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 MarcosCamara01 电子商务模板的购物车与结账流程中，存在“对外部可控制的假设不可变 Web 参数”（CWE-472）漏洞。该漏洞允许无特殊权限的已认证用户，在订购某商品时仅被收取另一商品的价格。其根本原因在于：POST /api/user/cart 接口将 variantId（决定订单记录的商品变体）与 stripeId（决定 Stripe 实际扣费的价格）作为请求体中的两个独立字段接收，并将两者均存储于购物车行中，但未实施任何校验以确保 stripeId 必须属于对应的 variantId。 随后

CVSS 7.1 · High

Affected Version Matrix 1

VendorProduct Version RangeStatus
MarcosCamara01 Ecommerce Template 2aa8ec539b6b441632096ced78e099fb096a57da< e6b364cd668f2ba875cfa7f6d55c63e771715df7 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-115450

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Price manipulation in the Ecommerce Template checkout flow through a client supplied Stripe price identifier
Source: CVE Program / CVE List V5
Vulnerability Description
External Control of Assumed-Immutable Web Parameter (CWE-472) in the cart and checkout flow of MarcosCamara01 Ecommerce Template allows an authenticated user with no special privileges to be charged the price of one product while placing an order for another, because POST /api/user/cart accepts variantId, which determines what the order records, and stripeId, which determines what Stripe charges, as two independent fields of the request body, stores both on the cart row, and no check requires the stripeId to be the one that belongs to the variantId. POST /api/stripe/payment builds the Stripe Checkout line items from the stored value, as { price: item.stripeId, quantity }, so the amount charged is the amount of that Stripe price. The checkout.session.completed webhook then creates the order products from the variantId of the same cart row, so the order records a product that was not paid for. Every stripeId in the catalogue is readable by any visitor, so no value has to be guessed. This results in orders for goods at the price of the cheapest item in the catalogue, repeatable without limit, and in order records whose amount does not correspond to the product they list.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
对假设不可变Web参数的外部可控制
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
MarcosCamara01 Ecommerce Template 2aa8ec539b6b441632096ced78e099fb096a57da ~ e6b364cd668f2ba875cfa7f6d55c63e771715df7 -

II. Public POCs for CVE-2026-115450

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-115450

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-115450 (1)

Vendor Advisories for CVE-2026-115450 (1)

IV. Related Vulnerabilities

Same product: Ecommerce Template
Same vendor: MarcosCamara01
Same weakness: CWE-472

V. Comments for CVE-2026-115450

No comments yet

Leave a comment