Executive brief
Vvveb CMS, an e-commerce and content management platform, contains a flaw that allows unauthenticated users to add negative quantities of items to their shopping carts. This results in the creation of orders with negative totals, effectively making it appear that the merchant owes the customer money. Such orders can corrupt accounting records, trigger incorrect tax filings, and potentially automate unauthorized refunds or manipulate inventory levels.
Technical details
The vulnerability exists in the cart-add handler of Vvveb CMS due to a lack of input validation on the 'quantity' parameter. An unauthenticated attacker can submit a negative integer via a POST request to the cart-add endpoint. The application processes this value without sanitization, propagating the negative sign through all downstream business logic, including line totals, tax calculations, and the final grand total. This results in the persistence of orders with negative values in the merchant's database. The flaw is exploitable by any guest user without special configuration or CSRF tokens. The issue is resolved in version 1.0.8.2 by enforcing positive integer checks on quantities.
Affected products
- givanz Vvveb CMS < 1.0.8.2
Timeline
- 2026-05-04: advisory: GitHub security advisory published
- 2026-05-15: disclosed: CVE published to NVD