CVE-2026-56831

Shopper is a Headless e-commerce Admin Panel. Prior to 2.9.0, the /cpanel/discounts administrative interface accepts negative fixed_amount discount values, persists them in sh_discounts, and passes them through vendor/shopper/cart/src/Discounts/DiscountCalculator.php and vendor/shopper/cart/src/Pipelines/Calculate.php without enforcing a positive-value invariant. Because the calculation subtracts discountTotal from the subtotal, a negative discount increases the resulting order total instead of reducing it. Malformed discount records can therefore cause incorrect pricing and financial data integrity failures, although the advisory does not establish a customer-facing exploitation path. This issue is fixed in version 2.9.0.

Shopper is a Headless e-commerce Admin Panel. Prior to 2.9.0, the /cpanel/discounts administrative interface accepts negative fixed_amount discount values, persists them in sh_discounts, and passes them through vendor/shopper/cart/src/Discounts/DiscountCalculator.php and vendor/shopper/cart/src/Pipelines/Calculate.php without enforcing a positive-value invariant. Because the calculation subtracts discountTotal from the subtotal, a negative discount increases the resulting order total instead of reducing it. Malformed discount records can therefore cause incorrect pricing and financial data integrity failures, although the advisory does not establish a customer-facing exploitation path. This issue is fixed in version 2.9.0.

Summary

The Shopper Framework discount management functionality accepts negative discount values without server-side validation.

It was confirmed that negative fixed-amount discounts can be created through the administrative interface, persisted to the database, and subsequently processed by the cart/order calculation pipeline.

The application appears to assume that discount values are always positive but does not enforce this assumption during creation, storage, or calculation.

As a result, malformed discount records can influence financial calculations and produce unintended order totals.

---

Affected Product

Package: shopper/framework

Version Tested: 2.8.1

---

Vulnerability Type

• Business Logic Vulnerability
• Improper Input Validation (CWE-20)

---

Description

While reviewing the discount functionality, it was discovered that the application accepts negative discount values through the administrative interface.

Example values tested:

-50.00
-99,999,999.00

The application accepted these values without validation and stored them in the database.

Example records observed in the sh_discounts table:

1 | QCZ5Y3HESM | fixed_amount | -5000
4 | TOZKAHCB4S | fixed_amount | -9999999900

This demonstrates that negative discount values are successfully persisted.

---

Steps to Reproduce

1. Create a Discount

Login as an administrator.

Navigate to:

/cpanel/discounts

Create a new discount with the following values:

Type: fixed_amount
Value: -99999999

Save the discount.

2. Observe Successful Creation

The discount is accepted by the application and displayed in the administration interface.

Example:

Code: TOZKAHCB4S
Amount: -$99,999,999.00

3. Verify Database Persistence

Inspect the database:

select * from sh_discounts;

Observed entry:

TOZKAHCB4S | fixed_amount | -9999999900

---

Technical Analysis

Discount Calculation

File:

vendor/shopper/cart/src/Discounts/DiscountCalculator.php

Observed code:

$fixedAmount = $discount->value;

The value is later processed without validation:

$fixedAmount = min($fixedAmount, $applicableSubtotal);

When a negative value is supplied:

min(-9999999900, 10000)

returns:

-9999999900

allowing the negative value to continue through the calculation pipeline.

The resulting adjustment values are inserted into the database:

CartLineAdjustment::query()->insert($adjustments);

No validation was identified to ensure that discount amounts are positive before calculations occur.

---

Final Total Calculation

File:

vendor/shopper/cart/src/Pipelines/Calculate.php

Observed logic:

$context->total = max(
    0,
    $context->taxInclusive
        ? $context->subtotal - $context->discountTotal
        : $context->subtotal - $context->discountTotal + $context->taxTotal
);

Because negative discount values are allowed to reach this stage, financial calculations are performed using malformed discount data.

Example:

Subtotal      = 10000
DiscountTotal = -5000

Resulting calculation:

10000 - (-5000)

Result:

15000

This demonstrates that negative discount values directly affect order total calculations.

---

Impact

The following was confirmed:

• Negative discount values are accepted.
• Negative discount values are persisted.
• Negative discount values are processed by the discount calculation engine.
• Negative discount values affect order total calculations.

Potential consequences include:

• Incorrect pricing calculations.
• Financial data integrity issues.
• Unexpected order totals.
• Violated assumptions within downstream pricing logic.
• Future vulnerabilities if additional components assume discount values are always positive.

Because Shopper is a headless e-commerce administration framework and does not ship with…

Shopper is a Headless e-commerce Admin Panel. Prior to 2.9.0, the /cpanel/discounts administrative interface accepts negative fixed_amount discount values, persists them in sh_discounts, and passes them through vendor/shopper/cart/src/Discounts/DiscountCalculator.php and vendor/shopper/cart/src/Pipelines/Calculate.php without enforcing a positive-value invariant. Because the calculation subtracts discountTotal from the subtotal, a negative discount increases the resulting order total instead of reducing it. Malformed discount records can therefore cause incorrect pricing and financial data integrity failures, although the advisory does not establish a customer-facing exploitation path. This issue is fixed in version 2.9.0.

Shopper is a Headless e-commerce Admin Panel. Prior to 2.9.0, the /cpanel/discounts administrative interface accepts negative fixed_amount discount values, persists them in sh_discounts, and passes them through vendor/shopper/cart/src/Discounts/DiscountCalculator.php and vendor/shopper/cart/src/Pipelines/Calculate.php without enforcing a positive-value invariant. Because the calculation subtracts discountTotal from the subtotal, a negative discount increases the resulting order total instead of reducing it. Malformed discount records can therefore cause incorrect pricing and financial data integrity failures, although the advisory does not establish a customer-facing exploitation path. This issue is fixed in version 2.9.0.

Summary

The Shopper Framework discount management functionality accepts negative discount values without server-side validation.

It was confirmed that negative fixed-amount discounts can be created through the administrative interface, persisted to the database, and subsequently processed by the cart/order calculation pipeline.

The application appears to assume that discount values are always positive but does not enforce this assumption during creation, storage, or calculation.

As a result, malformed discount records can influence financial calculations and produce unintended order totals.

---

Affected Product

Package: shopper/framework

Version Tested: 2.8.1

---

Vulnerability Type

• Business Logic Vulnerability
• Improper Input Validation (CWE-20)

---

Description

While reviewing the discount functionality, it was discovered that the application accepts negative discount values through the administrative interface.

Example values tested:

-50.00
-99,999,999.00

The application accepted these values without validation and stored them in the database.

Example records observed in the sh_discounts table:

1 | QCZ5Y3HESM | fixed_amount | -5000
4 | TOZKAHCB4S | fixed_amount | -9999999900

This demonstrates that negative discount values are successfully persisted.

---

Steps to Reproduce

1. Create a Discount

Login as an administrator.

Navigate to:

/cpanel/discounts

Create a new discount with the following values:

Type: fixed_amount
Value: -99999999

Save the discount.

2. Observe Successful Creation

The discount is accepted by the application and displayed in the administration interface.

Example:

Code: TOZKAHCB4S
Amount: -$99,999,999.00

3. Verify Database Persistence

Inspect the database:

select * from sh_discounts;

Observed entry:

TOZKAHCB4S | fixed_amount | -9999999900

---

Technical Analysis

Discount Calculation

File:

vendor/shopper/cart/src/Discounts/DiscountCalculator.php

Observed code:

$fixedAmount = $discount->value;

The value is later processed without validation:

$fixedAmount = min($fixedAmount, $applicableSubtotal);

When a negative value is supplied:

min(-9999999900, 10000)

returns:

-9999999900

allowing the negative value to continue through the calculation pipeline.

The resulting adjustment values are inserted into the database:

CartLineAdjustment::query()->insert($adjustments);

No validation was identified to ensure that discount amounts are positive before calculations occur.

---

Final Total Calculation

File:

vendor/shopper/cart/src/Pipelines/Calculate.php

Observed logic:

$context->total = max(
    0,
    $context->taxInclusive
        ? $context->subtotal - $context->discountTotal
        : $context->subtotal - $context->discountTotal + $context->taxTotal
);

Because negative discount values are allowed to reach this stage, financial calculations are performed using malformed discount data.

Example:

Subtotal      = 10000
DiscountTotal = -5000

Resulting calculation:

10000 - (-5000)

Result:

15000

This demonstrates that negative discount values directly affect order total calculations.

---

Impact

The following was confirmed:

• Negative discount values are accepted.
• Negative discount values are persisted.
• Negative discount values are processed by the discount calculation engine.
• Negative discount values affect order total calculations.

Potential consequences include:

• Incorrect pricing calculations.
• Financial data integrity issues.
• Unexpected order totals.
• Violated assumptions within downstream pricing logic.
• Future vulnerabilities if additional components assume discount values are always positive.

Because Shopper is a headless e-commerce administration framework and does not ship with…