Threats tagged 'ghsa-3q32-2fc9-c758'

A vulnerability in XiaozhangBang Voluntary Like System version 8.8 allows remote attackers to manipulate the 'zhekou' parameter in the /topfirst.php Pay module. This enables unauthorized discounts on vote purchases by sending crafted HTTP POST requests with abnormally low 'zhekou' values. Attackers can also modify the 'zid' parameter to affect purchases made by other users, leading to economic loss and unfair vote manipulation. The root cause is insufficient server-side validation of these parameters.