CyberRota Analysis
AI-GeneratedSylius versions prior to 2.1.16 and 2.2.9 are vulnerable due to inadequate validation of payment amounts during cart recalculation, enabling unauthenticated attackers to manipulate order totals post-transaction initiation. This flaw allows attackers to pay a minimal amount, inflate the order total, and have the system incorrectly mark the inflated amount as fully paid, despite only the original amount being captured by the payment gateway. E-commerce platforms using affected versions should prioritize patching this vulnerability to prevent potential financial losses and fraud.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Sylius versions before 2.1.16 and 2.2.9 fail to validate payment amounts during cart recalculation, allowing unauthenticated attackers to modify order totals after gateway transaction initiation. Attackers can pay a small amount, enlarge the order after gateway capture, and have the system mark the inflated order as fully paid while the gateway captured only the original amount.