CVE-2024-2151: Online Mobile Store Business Logic Vulnerability

CVE-2024-2151 Overview

CVE-2024-2151 is a business logic vulnerability in SourceCodester Online Mobile Management Store 1.0, developed by oretnom23. The flaw resides in the Product Price Handler component, where the quantity parameter fails to reject negative integer values. Supplying -1 as the quantity manipulates price calculations, producing incorrect totals that favor the attacker. The issue is exploitable remotely over the network without authentication or user interaction. The weakness is tracked as [CWE-840: Business Logic Errors] and is identified in VulDB as entry 255583.

Critical Impact
Remote unauthenticated attackers can manipulate order totals by injecting negative quantities, resulting in integrity loss on transaction pricing and financial calculations.

Affected Products

oretnom23 Online Mobile Store Management System 1.0
Component: Product Price Handler
Deployments referencing CPE cpe:2.3:a:oretnom23:online_mobile_store_management_system:1.0

Discovery Timeline

2024-03-04 - CVE-2024-2151 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-2151

Vulnerability Analysis

The vulnerability exists in the Product Price Handler of the Online Mobile Store Management System. The handler multiplies unit price by the supplied quantity value without validating that the input is a positive integer. When a client submits -1 as the quantity, the resulting subtotal becomes negative, which distorts cart totals, discounts, and downstream financial records.

Business logic flaws of this class bypass conventional input filters because the payload is syntactically valid data. No character escaping or SQL parsing catches the issue. The application simply accepts numeric input the developer never anticipated. This is classified as [CWE-840].

The attack requires no authentication, no privileges, and no user interaction. It executes remotely against exposed HTTP endpoints of the application. Exploitation affects integrity of transactional data but does not disclose sensitive information or crash the service.

Root Cause

The root cause is missing server-side validation on the quantity input field. The application trusts client-supplied numeric values and performs arithmetic operations directly against them. There is no lower bound check enforcing that quantity >= 1, and there is no server-side sanity check on computed subtotals before they are persisted or displayed.

Attack Vector

An attacker sends a crafted HTTP request to the Product Price Handler endpoint with quantity=-1. The server processes the request, calculates a negative line item value, and applies it to the order. The attacker can combine multiple items with mixed positive and negative quantities to reduce a legitimate order total below the intended price. Reference technical write-up: GitHub Business Logic Analysis.

No verified proof-of-concept code is published in NVD-linked repositories. See the VulDB #255583 entry for additional metadata.

Detection Methods for CVE-2024-2151

Indicators of Compromise

HTTP POST or GET requests containing quantity=- or negative numeric quantity parameters directed at cart, checkout, or product endpoints.
Order records in the application database with negative line-item quantities or subtotals below the expected minimum.
Unexplained downward adjustments to order totals that do not correspond to configured discount codes.

Detection Strategies

Deploy application-layer inspection rules on the web application firewall to flag numeric parameters with leading minus signs on transactional endpoints.
Correlate web access logs with backend order tables to identify sessions producing negative subtotals or improbable price reductions.
Baseline expected quantity value ranges per endpoint and alert on deviations outside 1 to a reasonable business maximum.

Monitoring Recommendations

Log all cart and checkout mutation requests with full parameter payloads for forensic replay.
Monitor completed orders for negative amounts, zero-dollar transactions on paid products, and refunds without matching return workflows.
Alert on repeated requests from a single source IP that submit invalid quantity values in short intervals.

How to Mitigate CVE-2024-2151

Immediate Actions Required

Enforce server-side validation on the quantity parameter, rejecting any value less than 1 before it reaches pricing logic.
Restrict public access to the Online Mobile Store Management System until validation controls are deployed.
Audit existing order records for negative quantities or anomalous totals produced since deployment.

Patch Information

No vendor advisory or official patch is listed in the NVD references for CVE-2024-2151. Operators should track the vendor's project page and the VulDB #255583 CTI record for update notifications. Until a vendor fix is released, apply the workarounds below.

Workarounds

Add input validation in the Product Price Handler to cast quantity to a positive integer and reject non-conforming input with an HTTP 400 response.
Configure a WAF rule to block requests where quantity matches a negative numeric pattern.
Implement a database constraint requiring quantity > 0 and line_total >= 0 on order tables.
Add a server-side post-calculation check that rejects order submissions with subtotals or totals below zero.

bash

# Example ModSecurity rule to block negative quantity values
SecRule ARGS:quantity "@rx ^-\d+$" \
    "id:1002151,\
    phase:2,\
    deny,\
    status:400,\
    msg:'CVE-2024-2151 - Negative quantity blocked',\
    tag:'business-logic',\
    tag:'CWE-840'"