CVE-2022-0689 (PHP, published 2022-02-19T16:15Z)
Description: value: Use multiple time the one-time coupon in Packagist microweber/microweber prior to 1.2.11.
Severity: MEDIUM (CVSS v3 base score: 5.3)
Weakness: NVD-CWE-Other \u2014 Other
NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
Repository: https://github.com/microweber/microweber
Files changed:
src/MicroweberPackages/Cart/CartManager.php
src/MicroweberPackages/Checkout/CheckoutManager.php
userfiles/modules/shop/coupons/functions.php
Commit message: update


Vulnerable code:
        $coupon_code = $this->app->user_manager->session_get('coupon_code');
        $this->coupon_data = coupon_get_by_code($coupon_code);
        if($return_amount ){
        if (empty($this->coupon_data)) {
        return  $this->coupon_data['discount_type'];
        if (empty($this->coupon_data)) {
        if ($this->sum() >= $this->coupon_data['total_amount']) {
            return floatval($this->coupon_data['discount_value']);
       // if ($this->app->user_manager->is_admin() == false) {
       // }
            'rel_type'=>$for,
            'rel_id'=>$for_id,
            'return_full'=>true,
                     }
                if (isset($item['qty']) and $item['qty'] != 'nolimit' ) {
                    $quantity =intval( $item['qty']);
                    if ($quantity < 1) {
                        $isInStock = false;
                    }
            // Discount details save
            $place_order['promo_code'] = $coupon_code;
            $place_order['coupon_id'] = $coupon_id;
            $place_order['discount_type'] = $discount_type;
            $place_order['discount_value'] = $discount_value;
    $checkout = new MicroweberPackages\Checkout\CheckoutManager();
    $getCart = $checkout->app->shop_manager->get_cart(array(
        'session_id' => $checkout->app->user_manager->session_id()

    ));
    $cartTotal = floatval(cart_total());

Fixed code:

        if ($return_amount) {
        $data = $this->couponCodeGetDataFromSession();
        if (empty($data)) {
        if (isset($data['discount_type'])) {
            return $data['discount_type'];
        }
        return false;
    }
    public function set_coupon_data($data)
    {
        $this->coupon_data = $data;
        $data = $this->couponCodeGetDataFromSession();


        if (empty($data)) {
            return false;
        }

        if (!isset($data['discount_value'])) {
            return false;
        }

        if (!isset($data['total_amount'])) {
        if ($this->sum() >= $data['total_amount']) {
            return floatval($data['discount_value']);
        // if ($this->app->user_manager->is_admin() == false) {
        // }
            'rel_type' => $for,
            'rel_id' => $for_id,
            'return_full' => true,
                    }
            if (isset($item['qty']) and $item['qty'] != 'nolimit') {
                $quantity = intval($item['qty']);
                if ($quantity < 1) {
                    $isInStock = false;
            }
    public function couponCodeGetDataFromSession()
    {
        $coupon_code = $this->app->user_manager->session_get('coupon_code');
        if ($coupon_code and !$this->couponCodeCheckIfValid($coupon_code)) {
            //check if coupon is valid
            if (function_exists('coupons_delete_session')) {
                coupons_delete_session();
            }

            $this->coupon_data = false;
        } else {
            if (function_exists('coupon_get_by_code')) {
                $this->coupon_data = coupon_get_by_code($coupon_code);
            } else {
                $this->coupon_data = false;
            }
        }
        return $this->coupon_data;
    }

    public function couponCodeCheckIfValid($coupon_code)
    {
        if (function_exists('coupon_apply')) {
            //check if coupon is valid
            $coupon_valid = coupon_apply([
                'coupon_code' => $coupon_code,
                'coupon_check_if_valid' => true
            ]);
            if (!$coupon_valid) {
                return false;
            }
            return true;
        }
        return false;

    }



            // Discount details save
            if ($coupon_code) {
                $place_order['promo_code'] = $coupon_code;
                $place_order['coupon_id'] = $coupon_id;
                $place_order['discount_type'] = $discount_type;
                $place_order['discount_value'] = $discount_value;


                if (!$this->app->cart_manager->couponCodeCheckIfValid($coupon_code)) {
                    //check if coupon is valid
                    if(function_exists('coupons_delete_session')){
                        coupons_delete_session();
                    }

                    $place_order['promo_code'] = '';
                    $place_order['coupon_id'] ='';
                    $place_order['discount_type'] = '';
                    $place_order['discount_value'] ='';
                }
            }







//    $checkout = new MicroweberPackages\Checkout\CheckoutManager();
//    $getCart = $checkout->app->shop_manager->get_cart(array(
//        'session_id' => $checkout->app->user_manager->session_id()
//
//    ));
    $getCart = false;
    $cartTotal = floatval( \DB::table('cart')->where('session_id', app()->user_manager->session_id())->sum('price'));
    $getCartItems =   \DB::table('cart')->where('session_id', app()->user_manager->session_id())->get();

    if($getCartItems){
        $getCart = $getCartItems->toArray();
    }
    if(isset( $params['coupon_check_if_valid'])){
       return $ok;
    }


    mw()->user_manager->session_del('applied_coupon_data');