CVE-2025-15116 Details

A critical race condition vulnerability has been identified in OpenCart versions through 4.1.0.3. This vulnerability allows unauthenticated (guest) attackers to manipulate the checkout process by sending concurrent requests that bypass essential business logic checks. As a result, two significant issues arise: first, 'single-use' coupons can be exploited multiple times on different orders, and second, products can be sold beyond their available stock, leading to negative inventory levels. This flaw is rooted in a time-of-check to time-of-use (TOCTOU) error, where the application fails to properly manage database locks during coupon and product validation, allowing simultaneous transactions to interfere with each other.

It is recommended to implement database locking mechanisms to prevent concurrent transactions from interfering with each other. This can be done by using 'SELECT ... FOR UPDATE' to lock the relevant database rows during the checkout process. Additionally, consider adding database constraints to prevent stock values from falling below zero.