CVE-2026-105573: newbee-ltd newbee-mall Shopping Cart Quantity updateAccountHeadAndDetail logic error
A vulnerability was found in newbee-ltd newbee-mall up to 2.7.5. This impacts an unknown function of the file /jshERP-boot/accountHead/updateAccountHeadAndDetail of the component Shopping Cart Quantity Handler. Performing a manipulation of the argument goodsCount results in business logic errors. The attack can be initiated remotely. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs low-privileged access and network reachability to the affected endpoint. No user interaction is required.
What must an attacker do to trigger the flaw?
The attacker manipulates the goodsCount argument handled by /jshERP-boot/accountHead/updateAccountHeadAndDetail. This causes a business-logic error in shopping-cart quantity processing.
Which versions are known to be affected?
newbee-ltd newbee-mall versions up to 2.7.5 are reported as affected. The provided data does not identify a fixed version.
Is exploitation publicly available?
Yes. A public exploit has been reported, increasing the likelihood that the issue could be used by other attackers.
What can be done if a patch is not available?
The provided data does not specify a workaround. Restrict access to the affected endpoint to authorized low-privilege users only and monitor requests that manipulate the goodsCount parameter.