CVE-2023-6832: Business Logic Errors (CWE-840)
value: Business Logic Errors in GitHub repository microweber/microweber prior to 2.0.
CWE description: Weaknesses in this category identify some of the underlying problems that commonly allow attackers to manipulate the business logic of an application. Errors in business logic can be devastating to an entire application. They can be difficult to find automatically, since they typically involve legitimate use of the application's functionality. However, many business logic errors can exhibit patterns that are similar to well-understood implementation and design weaknesses.
CVSS v3 base score: 4.3
Published: 2023-12-15T01:15Z
Repository: https://github.com/microweber/microweber
Language: PHP
Files changed: src/MicroweberPackages/Checkout/CheckoutManager.php, userfiles/modules/shop/coupons/admin.php, userfiles/modules/shop/coupons/functions.php
Commit date: 2023-06-09 12:23:44 +0300
Commit message: update

Diff: diff --git a/src/MicroweberPackages/Checkout/CheckoutManager.php b/src/MicroweberPackages/Checkout/CheckoutManager.php
index a4f038385cb..658e45e861e 100644
--- a/src/MicroweberPackages/Checkout/CheckoutManager.php
+++ b/src/MicroweberPackages/Checkout/CheckoutManager.php
@@ -406,14 +406,14 @@ class CheckoutManager
                 if (isset($data[$value]) and ($data[$value]) != false) {
                     $place_order[$value] = $data[$value];
                     $posted_fields[$value] = $data[$value];
                 }
             }
-
+            $canUseCoupons = $this->app->option_manager->get('enable_coupons', 'shop') == 1;
 
             // Discount details save
-            if ($coupon_code) {
+            if ($canUseCoupons and $coupon_code) {
                 $place_order['promo_code'] = $coupon_code;
                 $place_order['coupon_id'] = $coupon_id;
                 $place_order['discount_type'] = $discount_type;
                 $place_order['discount_value'] = $discount_value;
 
diff --git a/userfiles/modules/shop/coupons/admin.php b/userfiles/modules/shop/coupons/admin.php
index cad53fdd6a9..433ca3bd491 100644
--- a/userfiles/modules/shop/coupons/admin.php
+++ b/userfiles/modules/shop/coupons/admin.php
@@ -82,11 +82,11 @@ $coupon_get_count = coupon_get_count();
 
             <?php
             if ($coupon_get_count > 0) {
                 ?>
                 <label class="form-check form-check-single form-switch ps-0 mb-4" style="width: unset;">
-                    <input type="checkbox" name="enable_coupons" class="mw_option_field form-check-input" id="enable_coupons" data-option-group="shop" data-value-checked="y" data-value-unchecked="n" <?php if (get_option('enable_coupons', 'shop') == 1): ?>checked<?php endif; ?> />
+                    <input type="checkbox" name="enable_coupons" class="mw_option_field form-check-input" id="enable_coupons" data-option-group="shop" data-value-checked="1" data-value-unchecked="0" <?php if (get_option('enable_coupons', 'shop') == 1): ?>checked<?php endif; ?> />
                     &nbsp; <?php _e('Enable'); ?>
                 </label>
             <?php
             }
             ?>
diff --git a/userfiles/modules/shop/coupons/functions.php b/userfiles/modules/shop/coupons/functions.php
index 4b61dac0148..3303b7d1cf6 100644
--- a/userfiles/modules/shop/coupons/functions.php
+++ b/userfiles/modules/shop/coupons/functions.php
@@ -19,10 +19,15 @@ function coupon_apply($params = array())
     $errorMessage = '';
 
     $coupon_code = $params['coupon_code'];
     $coupon_code = xss_clean($coupon_code);
 
+    if (get_option('enable_coupons', 'shop') == 0){
+        $json['error_message'] = _e('The coupon code usage is disabled.', true);
+        return $json;
+    }
+
     $coupon = coupon_get_by_code($coupon_code);
     if (empty($coupon)) {
         $json['error_message'] = _e('The coupon code is not valid.', true);
         return $json;
     }

Vulnerable code: 
            if ($coupon_code) {
                    <input type="checkbox" name="enable_coupons" class="mw_option_field form-check-input" id="enable_coupons" data-option-group="shop" data-value-checked="y" data-value-unchecked="n" <?php if (get_option('enable_coupons', 'shop') == 1): ?>checked<?php endif; ?> />
Fixed code:             $canUseCoupons = $this->app->option_manager->get('enable_coupons', 'shop') == 1;
            if ($canUseCoupons and $coupon_code) {
                    <input type="checkbox" name="enable_coupons" class="mw_option_field form-check-input" id="enable_coupons" data-option-group="shop" data-value-checked="1" data-value-unchecked="0" <?php if (get_option('enable_coupons', 'shop') == 1): ?>checked<?php endif; ?> />
    if (get_option('enable_coupons', 'shop') == 0){
        $json['error_message'] = _e('The coupon code usage is disabled.', true);
        return $json;
    }