Extension Typo3 Shop By Coding Ms
Monthly
The coding.ms 'typo3_shop' extension for TYPO3 lets any unauthenticated site visitor force orders that are still awaiting payment into the 'canceled' state by supplying an order identifier to the cancellation function, which performs no ownership check (CWE-862, IDOR-style missing authorization, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N). The exposure is conditional on the site publishing a page that hosts the shop's order/cancellation plugin - without that reachable plugin the endpoint cannot be invoked - and already-paid orders are explicitly unaffected, so impact is confined to integrity of pending, unpaid transactions that the attacker can enumerate or guess. No public exploit code was identified at time of analysis and the issue is not in CISA KEV, so exploitation would be opportunistic rather than confirmed in the wild; successful abuse is a low-complexity, unauthenticated nuisance/fraud vector that can disrupt live storefronts by silently invalidating unpaid checkouts.
Unauthenticated attackers can overwrite the stored PayPal payment notification for an unpaid order on TYPO3 sites running the coding.ms shop extension when a page exposes the shop's order plugin. The endpoint accepts notification data without verifying its origin, so the impact is limited to integrity of the notification content for orders still awaiting payment; paid orders are unaffected, and confidentiality and availability are not impacted. No public exploit code or CISA KEV entry was identified in the provided data at time of analysis.
The coding.ms 'typo3_shop' extension for TYPO3 lets any unauthenticated site visitor force orders that are still awaiting payment into the 'canceled' state by supplying an order identifier to the cancellation function, which performs no ownership check (CWE-862, IDOR-style missing authorization, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N). The exposure is conditional on the site publishing a page that hosts the shop's order/cancellation plugin - without that reachable plugin the endpoint cannot be invoked - and already-paid orders are explicitly unaffected, so impact is confined to integrity of pending, unpaid transactions that the attacker can enumerate or guess. No public exploit code was identified at time of analysis and the issue is not in CISA KEV, so exploitation would be opportunistic rather than confirmed in the wild; successful abuse is a low-complexity, unauthenticated nuisance/fraud vector that can disrupt live storefronts by silently invalidating unpaid checkouts.
Unauthenticated attackers can overwrite the stored PayPal payment notification for an unpaid order on TYPO3 sites running the coding.ms shop extension when a page exposes the shop's order plugin. The endpoint accepts notification data without verifying its origin, so the impact is limited to integrity of the notification content for orders still awaiting payment; paid orders are unaffected, and confidentiality and availability are not impacted. No public exploit code or CISA KEV entry was identified in the provided data at time of analysis.