PHP-Bookstore-Website-Example CVE-2025-11594

Requires a reachable instance of the ywxbear PHP-Bookstore-Website-Example application with the Quantity Handler in /index.php exposed - i.e., the checkout/cart purchase flow accessible to anonymous visitors (the default for a storefront). The attacker supplies a manipulated 'quantity' input that the application fails to validate properly (CWE-703). No authentication, no user interaction, and no non-default configuration are needed (PR:N/UI:N). LIMITING FACTORS: impact is confined to low integrity (VI:L) - order/payment-logic manipulation within the app - with no confidentiality or availability impact and no system compromise; practical damage depends on whether the manipulated order actually drives a real payment/fulfillment process.

This is a medium-severity business-logic flaw (CVSS 4.0 base 5.5) in a hobby-grade GitHub example application, and the real-world priority is LOW despite a publicly disclosed exploit. The CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates trivial remote, unauthenticated exploitation, but the impact is deliberately narrow: VC:N, VI:L, VA:N - only a low integrity impact, consistent with manipulating the purchase quantity in the payment/order flow rather than compromising the host. EPSS is low (0.38%, 30th percentile) and the CVE is NOT on CISA KEV, so there is no evidence of active or widespread exploitation; the E:P (Proof-of-Concept) maturity in the vector aligns with the description's statement that an exploit was publicly disclosed. CONFLICTING SIGNAL: the 'Information Disclosure' tag contradicts the CVSS metrics, which show VC:N (no confidentiality impact) and VI:L - this is an integrity/business-logic issue (improper quantity validation), not information disclosure; treat the tag as suspect. Net: easy to trigger but low consequence on an obscure codebase, so this is a high-exploitability/low-impact finding rather than an urgent threat.

An unauthenticated attacker browsing the bookstore submits a crafted or out-of-range quantity value (e.g., negative or manipulated) to the Quantity Handler in /index.php during cart/checkout, defeating the server-side quantity validation to distort order totals or payment logic. Because the attack is network-based with low complexity and no authentication or user interaction required, it can be performed directly against a live instance. A proof-of-concept has been publicly disclosed (referenced as a 'Payment Logic Vulnerability' document), so working exploit details are available.