CVE-2024-53476

CVE-2024-53476 描述 SimplCommerce 的结账逻辑存在竞争条件漏洞，允许多个用户通过同时发送结账请求购买超过库存数量的商品。 检测方法 攻击者可以通过使用两个账户，在几乎同一时间尝试购买库存稀缺的商品（库存=1）来检测此漏洞。如果两个账户都成功购买了该商品，则确认存在竞争条件。这可以通过自定义脚本或 Burp Suite Turbo Intruder 发送并发结账请求来实现。 测试于 230310c8d7a0408569b292c5a805c459d47a1d8f 提交 链接 https://www.simplcommerce.com/...

CVE-2026-30574

CVE-2026-30574 affects SourceCodester Pharmacy Product Management System 1.0, specifically the add-sales.php logic. The issue is a failure to validate that the requested sales quantity (txtqty) does not exceed available stock, allowing an attacker to Manipulate the request to oversell beyond stoc...

EUVD-2024-51975

Malicious code in bioql PyPI...

CVE-2024-53476

A race condition vulnerability in SimplCommerce at commit 230310c8d7a0408569b292c5a805c459d47a1d8f allows attackers to bypass inventory restrictions by simultaneously submitting purchase requests from multiple accounts for the same product. This can lead to overselling when stock is limited, as t...

CVE-2024-53476

A race condition vulnerability in SimplCommerce at commit 230310c8d7a0408569b292c5a805c459d47a1d8f allows attackers to bypass inventory restrictions by simultaneously submitting purchase requests from multiple accounts for the same product. This can lead to overselling when stock is limited, as t...

CVE-2024-53476

A race condition vulnerability in SimplCommerce at commit 230310c8d7a0408569b292c5a805c459d47a1d8f allows attackers to bypass inventory restrictions by simultaneously submitting purchase requests from multiple accounts for the same product. This can lead to overselling when stock is limited, as t...

CVE-2024-53476

A race condition vulnerability in SimplCommerce at commit 230310c8d7a0408569b292c5a805c459d47a1d8f allows attackers to bypass inventory restrictions by simultaneously submitting purchase requests from multiple accounts for the same product. This can lead to overselling when stock is limited, as t...

CVE-2024-53476

A race condition vulnerability in SimplCommerce at commit 230310c8d7a0408569b292c5a805c459d47a1d8f allows attackers to bypass inventory restrictions by simultaneously submitting purchase requests from multiple accounts for the same product. This can lead to overselling when stock is limited, as t...

PT-2024-35754 · Unknown · Simplcommerce

Name of the Vulnerable Software and Affected Versions: SimplCommerce version 230310c8d7a0408569b292c5a805c459d47a1d8f Description: A race condition issue in the checkout logic allows attackers to bypass inventory restrictions by simultaneously submitting purchase requests from multiple accounts f...

TokenInLimit can be set higher than what the contract has to sell

Lines of code Vulnerability details Impact If totalTokenOutBought tokenOut.balanceOfaddressthis all tokens will be unclaimable and all funds would be lost. Proof of Concept TokenInLimit can be set arbitrarily high even if the contract doesn't have enough tokens to sell. Then users can buy more...

TokenInLimit can be set arbitrarily high even if the contract doesn't have enough tokens to sell.

Lines of code Vulnerability details Impact If totalTokenOutBought tokenOut.balanceOfaddressthis the finalize function will forever revert and no-one will be able to claim their bought tokens. Proof of Concept TokenInLimit can be set arbitrarily high even if the contract doesn't have enough tokens...