Shopper: Negative discount values accepted and propagated through order calculation pipeline

The Shopper Framework discount management functionality accepts negative discount values without server-side validation.

It was confirmed that negative fixed-amount discounts can be created through the administrative interface, persisted to the database, and subsequently processed by the cart/order calculation pipeline.

The application appears to assume that discount values are always positive but does not enforce this assumption during creation, storage, or calculation.

As a result, malformed discount records can influence financial calculations and produce unintended order totals.

Package: shopper/framework

Version Tested: 2.8.1

• Business Logic Vulnerability
• Improper Input Validation (CWE-20)

While reviewing the discount functionality, it was discovered that the application accepts negative discount values through the administrative interface.

Example values tested:

 1-50.00
 2-99,999,999.00

The application accepted these values without validation and stored them in the database.

Example records observed in the sh_discounts table:

 11 | QCZ5Y3HESM | fixed_amount | -5000
 24 | TOZKAHCB4S | fixed_amount | -9999999900

This demonstrates that negative discount values are successfully persisted.

1. Create a Discount

Login as an administrator.

Navigate to:

 1/cpanel/discounts

Create a new discount with the following values:

 1Type: fixed_amount
 2Value: -99999999

Save the discount.

2. Observe Successful Creation

The discount is accepted by the application and displayed in the administration interface.

Example:

 1Code: TOZKAHCB4S
 2Amount: -$99,999,999.00

3. Verify Database Persistence

Inspect the database:

 1select * from sh_discounts;

Observed entry:

 1TOZKAHCB4S | fixed_amount | -9999999900

Discount Calculation

File:

 1vendor/shopper/cart/src/Discounts/DiscountCalculator.php

Observed code:

 1$fixedAmount = $discount->value;

The value is later processed without validation:

 1$fixedAmount = min($fixedAmount, $applicableSubtotal);

When a negative value is supplied:

 1min(-9999999900, 10000)

returns:

 1-9999999900

allowing the negative value to continue through the calculation pipeline.

The resulting adjustment values are inserted into the database:

 1CartLineAdjustment::query()->insert($adjustments);

No validation was identified to ensure that discount amounts are positive before calculations occur.

Final Total Calculation

File:

 1vendor/shopper/cart/src/Pipelines/Calculate.php

Observed logic:

 1$context->total = max(
 2    0,
 3    $context->taxInclusive
 4        ? $context->subtotal - $context->discountTotal
 5        : $context->subtotal - $context->discountTotal + $context->taxTotal
 6);

Because negative discount values are allowed to reach this stage, financial calculations are performed using malformed discount data.

Example:

 1Subtotal      = 10000
 2DiscountTotal = -5000

Resulting calculation:

 110000 - (-5000)

Result:

 115000

This demonstrates that negative discount values directly affect order total calculations.

The following was confirmed:

• Negative discount values are accepted.
• Negative discount values are persisted.
• Negative discount values are processed by the discount calculation engine.
• Negative discount values affect order total calculations.

Potential consequences include:

• Incorrect pricing calculations.
• Financial data integrity issues.
• Unexpected order totals.
• Violated assumptions within downstream pricing logic.
• Future vulnerabilities if additional components assume discount values are always positive.

Because Shopper is a headless e-commerce administration framework and does not ship with a customer-facing storefront, it was not verified a customer-facing exploitation path.

However, malformed discount records currently propagate through pricing calculations without validation.

Implement server-side validation enforcing positive discount values before persistence and before entering the calculation pipeline.

Suggested validation:

Fixed Amount Discounts

 1value > 0

Percentage Discounts

 10 < value <= 100

Additionally, existing discount records should be validated before calculation to prevent malformed data from influencing pricing logic.