{"id":"CVE-2018-16157","aliases":["EUVD-2018-8011","GHSA-59m4-cw7c-c323"],"status":"published","title":"waimai Super Cms 20150505 has a logic flaw allowing attackers to modify a price, before form...","description":"waimai Super Cms 20150505 has a logic flaw allowing attackers to modify a price, before form submission, by observing data in a packet capture. By setting the index.php?m=cart\u0026a=save item_totals parameter to zero, the entire cart is sold for free.","severity":{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.00735,"percentile":0.54703,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"published":"2018-08-30T13:00:00Z","modified":"2026-06-17T01:43:47Z","products":[{"vendor":"bijiadao","product":"waimai_super_cms"}],"references":[{"url":"https://github.com/caokang/waimai/issues/5","tags":["x_refsource_MISC","x_transferred","Exploit","Issue Tracking","Third Party Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-16157"},{"url":"https://github.com/advisories/GHSA-59m4-cw7c-c323"}],"sources":{"cve":[{"id":"CVE-2018-16157","description":"waimai Super Cms 20150505 has a logic flaw allowing attackers to modify a price, before form submission, by observing data in a packet capture. By setting the index.php?m=cart\u0026a=save item_totals parameter to zero, the entire cart is sold for free.","status":"published","published":"2018-08-30T13:00:00Z","modified":"2024-08-05T10:17:38.27Z","updated_at":"2026-11-02T14:35:11.072321Z"}],"euvd":[{"id":"EUVD-2018-8011","description":"waimai Super Cms 20150505 has a logic flaw allowing attackers to modify a price, before form submission, by observing data in a packet capture. By setting the index.php?m=cart\u0026a=save item_totals parameter to zero, the entire cart is sold for free.","status":"published","published":"2018-08-30T13:00:00Z","modified":"2024-08-05T10:17:38Z","updated_at":"2026-11-03T02:39:42.716317Z"}],"ghsa":[{"id":"GHSA-59m4-cw7c-c323","title":"waimai Super Cms 20150505 has a logic flaw allowing attackers to modify a price, before form...","description":"waimai Super Cms 20150505 has a logic flaw allowing attackers to modify a price, before form submission, by observing data in a packet capture. By setting the index.php?m=cart\u0026a=save item_totals parameter to zero, the entire cart is sold for free.","status":"published","published":"2022-05-13T01:19:14Z","modified":"2023-02-01T05:05:47Z","cvss":[{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T14:50:16.912878Z"}],"nvd":[{"id":"CVE-2018-16157","description":"waimai Super Cms 20150505 has a logic flaw allowing attackers to modify a price, before form submission, by observing data in a packet capture. By setting the index.php?m=cart\u0026a=save item_totals parameter to zero, the entire cart is sold for free.","status":"published","published":"2018-08-30T13:29:00.86Z","modified":"2026-06-17T01:43:47.74Z","cvss":[{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"updated_at":"2026-11-02T14:04:36.842579Z"}]}}