CVE-2026-47198— Paymenter: URL parameter injection bypasses paid plan limits at checkout

Paymenter: URL parameter injection bypasses paid plan limits at checkout

Paymenter is a free and open-source webshop solution for management of hosting services. In versions prior to 1.5.1, the checkout component improperly filters URL-writable properties, allowing authenticated users to inject arbitrary key-value pairs into server provisioning parameters. Because bundled server extensions prioritize these user-supplied properties over administrator-defined configurations, a regular user can override hosting plans and resource limits at checkout without special privileges. The Checkout Livewire component's $checkoutConfig property exposed via URL query parameters, only validating keys explicitly defined by an extension's configuration method, allowing any undefined injected keys to bypass validation entirely. These unsanitized keys are then stored directly in the database by the cart component and later passed to server extensions during provisioning, enabling user-injected data to override intended administrator settings. Depending on the active extension, this leads to unauthorized overrides of core resource limits (such as CPU, RAM, storage, or package tiers). No administrative privileges are required to exploit this vulnerability. This issue has been fixed in version 1.5.1.

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:L

输入验证不恰当

Paymenter 输入验证错误漏洞

Paymenter是Paymenter公司开源的一个网店托管软件。 Paymenter 1.5.1之前版本存在安全漏洞，该漏洞源于结账组件不当过滤URL可写属性，允许经过身份验证的用户向服务器配置参数注入任意键值对，覆盖核心资源限制（如CPU、RAM、存储或套餐等级）。

N/A

N/A