CVE-2025-13239: Bdtask Isshue eCommerce RCE Vulnerability

CVE-2025-13239 Overview

CVE-2025-13239 affects Bdtask Isshue Multi Store eCommerce Shopping Cart Solution version 5.0, a commercial PHP-based retail platform distributed through CodeCanyon. The vulnerability resides in the /submit_checkout endpoint, where the application fails to enforce server-side validation of the order_total_amount and cart_total_amount parameters. An authenticated remote attacker can manipulate these values during checkout to bypass the intended pricing workflow. The flaw is categorized under [CWE-840] Business Logic Errors. The exploit has been disclosed publicly, and the vendor did not respond to disclosure attempts.

Critical Impact

Authenticated attackers can tamper with order and cart totals submitted to the checkout endpoint, bypassing the application's intended pricing workflow and undermining transactional integrity.

Affected Products

• Bdtask Isshue Multi Store eCommerce Shopping Cart Solution 5.0
• CodeCanyon distribution of Isshue 5.0
• Deployments exposing the /submit_checkout endpoint

Discovery Timeline

• 2025-11-16 - CVE-2025-13239 published to NVD
• 2026-04-29 - Last updated in NVD database

Technical Details for CVE-2025-13239

Vulnerability Analysis

The vulnerability is a business logic flaw in the checkout workflow of Isshue 5.0. The /submit_checkout handler accepts the order_total_amount and cart_total_amount parameters directly from the client request without recomputing or validating them against the authoritative server-side cart state. An authenticated user can intercept the checkout submission and substitute arbitrary numeric values for these parameters. The application then proceeds with order placement using the attacker-supplied totals rather than the prices stored server-side for the cart contents. This breaks the intended pricing and payment workflow, allowing orders to be completed at values not reflective of the actual catalog prices.

Root Cause

The root cause is improper enforcement of behavioral workflow [CWE-840]. The checkout logic trusts client-controlled totals instead of deriving them from server-side product records, cart line items, applied taxes, and shipping. No integrity check rejects mismatches between submitted totals and computed totals. Authentication is required, but any low-privilege customer account is sufficient.

Attack Vector

The attack is conducted remotely over the network against the /submit_checkout endpoint. An attacker authenticates as a regular customer, adds items to the cart, and intercepts the HTTP POST request issued during checkout. They modify the order_total_amount and cart_total_amount form fields to arbitrary values, then forward the request. The server processes the order using the manipulated totals. Public proof-of-concept material has been disclosed through the GitHub Issue Report and VulDB entry #332565.

No verified exploit code is reproduced here. The vulnerability mechanism is parameter tampering against unvalidated checkout totals submitted to /submit_checkout. See the linked VulDB and GitHub references for additional technical context.

Detection Methods for CVE-2025-13239

Indicators of Compromise

• Completed orders in the Isshue database where the stored order_total_amount does not match the sum of associated line item prices plus taxes and shipping.
• HTTP POST requests to /submit_checkout containing order_total_amount or cart_total_amount values that deviate from values rendered on the prior cart page for the same session.
• Unusual patterns of low-value orders containing high-value goods from a single customer account or IP address.

Detection Strategies

• Add server-side reconciliation logging that records both client-submitted totals and server-recomputed totals at checkout, then alert on any divergence.
• Deploy a web application firewall rule that inspects /submit_checkout POST bodies and flags requests where submitted totals fall outside expected catalog price ranges.
• Review order tables for anomalies such as totals below the minimum possible line-item cost or non-standard decimal precision indicative of manual tampering.

Monitoring Recommendations

• Enable verbose logging on the checkout controller and forward logs to a centralized analysis platform for correlation against catalog price data.
• Monitor for repeated checkout submissions from the same session with varying total values, which indicates active exploitation testing.
• Track post-purchase reconciliation reports daily to identify revenue discrepancies tied to specific orders.

How to Mitigate CVE-2025-13239

Immediate Actions Required

• Remove the order_total_amount and cart_total_amount parameters from the trusted input set and recompute all totals server-side from the authenticated cart record before persisting the order.
• Restrict access to /submit_checkout behind additional integrity checks, such as a signed cart token issued by the server and verified at submission.
• Audit historical orders for evidence of prior exploitation and initiate chargeback or order-cancellation procedures where tampering is confirmed.

Patch Information

No vendor patch is available. According to the disclosure, the vendor was contacted early but did not respond. Operators should apply compensating controls and consider migrating away from the affected platform if no fix is published. Track the VulDB CTI entry #332565 for updates.

Workarounds

• Implement a server-side validation layer that ignores client-submitted totals and recalculates the order amount from product, tax, and shipping tables.
• Place the application behind a reverse proxy or WAF that rejects /submit_checkout requests whose submitted totals do not match a server-computed signature.
• Disable customer self-checkout temporarily and route orders through a manual review queue until a code-level fix is deployed.

# Example WAF rule (ModSecurity) to block /submit_checkout requests
# containing client-supplied total parameters
SecRule REQUEST_URI "@streq /submit_checkout" \
    "id:1013239,phase:2,deny,status:403,\
    chain,msg:'CVE-2025-13239 checkout tampering attempt'"
    SecRule ARGS_NAMES "@rx ^(order_total_amount|cart_total_amount)$"