Executive brief
Cezerin is an e-commerce platform that processes online orders and payments. An attacker can modify order details—such as payment status or shipping fees—by manipulating the shopping cart checkout request, potentially reducing what they pay or falsifying order records, resulting in financial loss and order integrity issues.
Technical details
A mass-assignment / improper input validation vulnerability (CWE-20) in Cezerin v0.33.0 allows unauthenticated attackers to modify internal order attributes via the PUT /ajax/cart endpoint during checkout. The vulnerable code in api/server/services/orders/orders.js (getValidDocumentForUpdate function) fails to sanitize user-supplied attributes, permitting attackers to overwrite reserved fields such as payment status and shipping charges. The attack requires network access and no authentication, as it targets a public-facing checkout API. A malicious customer can inject arbitrary attributes into the request to alter order state, compromising payment integrity and shipping logic. No public patch information is available in the advisory.
Affected products
- Cezerin Cezerin 0.33.0 and earlier
Timeline
- 2019-10: disclosed: Published on NVD
- 2022-05-24: advisory: GHSA advisory published