CVE-2024-46307 is a high-severity vulnerability in Sparkshop v1.16 where a loophole in the payment logic permits attackers to arbitrarily alter the quantity of products during a transaction. The vulnerability has a CVSS 3.1 base score of 7.5, indicating network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, no confidentiality impact, high integrity impact, and no availability impact. This corresponds to CWE-841 (Improper Control of a Resource Through its Lifetime). No patch or official remediation has been provided as of the published date.

An attacker exploiting this vulnerability can manipulate the number of products in a payment transaction, compromising the integrity of the payment process. This could lead to financial discrepancies such as paying less than intended or other transaction manipulation. There is no indication of impact on confidentiality or availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or fix information is provided, users should monitor the vendor's official channels for updates. Until a fix is available, consider implementing additional validation or monitoring on payment quantities if possible.