Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.5
CVE-2004-0062: FishCart can produce negative order totals
CVE-2004-0062 · published 22 years ago
Summary
Certain versions of FishCart have a calculation error that lets a specially crafted order with a very large quantity produce a negative total. This could be used by an attacker to manipulate pricing or cause accounting issues. Update to the latest version of FishCart or apply the vendor’s patch to correct the rounding logic.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| fishnet | fishcart |
<= 3.1 cpe:2.3:a:fishnet:fishcart:*:*:*:*:*:*:*:* |
Original advisory text
Integer overflow in the rnd arithmetic rounding function for various versions of FishCart before 3.1 allows remote attackers to "cause negative totals" via an order with a large quantity.
Integer overflow in the rnd arithmetic rounding function for various versions of FishCart before 3.1 allows remote attackers to "cause negative totals" via an order with a large quantity.
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker partial control (estimated)
Severity
7.5
High
Timeline
Published17 Feb 2004
Updated4 Nov 2026
First seen29 Sep 2026
Sources
CVE-2004-0062 · NVD
Track software like this
Free during beta