CVE-2019-18608

Vulnerability

Overview

Cezerin v0.33.0, a React and Node.js based eCommerce platform, contains a vulnerability in the getValidDocumentForUpdate function within api/server/services/orders/orders.js. This function is responsible for processing order update requests. It fails to properly sanitize user-supplied input, allowing internal order attributes—such as paid, tax, or shipping_fee—to be overwritten by including a conflicting name in the request body [1][3].

Exploitation

Method

An unauthenticated malicious customer can exploit this by sending a crafted PUT request to the /ajax/cart endpoint during checkout. By adding extra JSON attributes (e.g., "paid": true) to the request payload, the server will accept and apply these values to the order document without proper validation [3]. The vulnerability is accessible without any special privileges or authentication, as the endpoint is publicly exposed.

Impact

Successful exploitation allows an attacker to manipulate critical order information, such as setting the payment status to paid without completing payment, or altering the shipping fee to zero. This can lead to financial loss for the merchant and unauthorized fulfillment of orders [1][3].

Mitigation

As of the advisory, Cezerin v0.33.0 is affected; no patched version was released at the time of disclosure. Users should upgrade to a later version if available, monitor for suspicious order modifications, or restrict access to the vulnerable endpoint until a fix is applied.