CVE-2020-21503

HIGH

waimai Super Cms 20150505 - Unauthenticated Price Manipulation via Credit Parameter

Title source: llm

Description

waimai Super Cms 20150505 has a logic flaw allowing attackers to modify a price, before form submission, by observing data in a packet capture. By setting the index.php?m=gift&a=addsave credit parameter to -1, the product is sold for free.

References (1)

Core 1

Core References

Exploit, Third Party Advisory x_refsource_misc

https://github.com/caokang/waimai/issues/15

Scores

CVSS v3 7.5

EPSS 0.0102

EPSS Percentile 58.7%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Details

CWE

CWE-668

Status published

Products (1)

waimai_super_cms_project/waimai_super_cms 20150505

Published Oct 05, 2021

Tracked Since Feb 18, 2026