FOSSBilling Cart Race Condition Vulnerability Leading to Coupon Abuse

Race Condition Vulnerability in FOSSBilling Shopping Cart Checkout Vulnerability Overview A race condition vulnerability exists in the shopping cart checkout process of FOSSBilling, allowing authenticated clients to apply promotional codes beyond their configured maximum usage limits. By sending concurrent checkout requests, a client can obtain unlimited discounts or free orders from promotional codes with single or limited uses, before a single request completes the usage increment. Scope of Impact Affected Versions: FOSSBilling versions 0.1.0 through 0.7.2 (all released versions) Fixed Version: 0.8.0 CVSS Score: 6.9/10 (Medium) Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Remediation Disable promotional codes until a patch is available. Alternatively, monitor the promotional table for usage values exceeding and manually review affected orders. Technical Details The vulnerability resides in . The checkout sequence is non-atomic: 1. calls , which delegates to . This function reads from the database and compares it with : 2. If the check passes, checkout proceeds to order creation and calls . 3. increments the counter in PHP and writes it back via RedBeanPHP's : There is no database-level locking (e.g., ), no transaction wrapping the check-and-increment operation, and no atomic compare-and-update mechanism. N concurrent requests all pass the check before writing the incremented value. Acknowledgments Thanks to @DilipMallavarapu (LinkedIn) for responsibly reporting this vulnerability.

Goal Reached Thanks to every supporter — we hit 100%!

FOSSBilling Cart Race Condition Vulnerability Leading to Coupon Abuse

More from this source