CyberRota Analysis
AI-GeneratedFOSSBilling versions prior to 0.8.0 are vulnerable to a race condition in the cart checkout process, allowing authenticated clients to exploit promo codes beyond their intended limits, potentially resulting in unlimited discounts or free orders. Organizations using this billing system should prioritize upgrading to version 0.8.0 or implementing available workarounds, as this vulnerability could lead to significant financial losses. Users should closely monitor promo code usage to mitigate the risk until a patch is applied.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
FOSSBilling is a free, open-source billing and client management system. Prior to version 0.8.0, a race condition in the cart checkout flow allows an authenticated client to apply a promo code beyond its configured maximum uses. By sending concurrent checkout requests before any single request completes the usage increment, a client can obtain unlimited discounted or free orders from a single-use or limited-use promo code. Version 0.8.0 patches the issue. Some workarounds are available. Disable promo codes entirely until a patch is available or monitor the `promo` table for `used` values exceeding `maxuses` and manually review affected orders.