CVE-2025-7954: 
PHP vulnerability analysis and mitigation

CVE-2025-7954 is a race condition vulnerability in Shopware's voucher system that allows attackers to bypass intended voucher usage restrictions and exceed predefined usage limitations. It was disclosed on August 6, 2025, and affects Shopware versions 6.6.0.0 through 6.6.10.4 (and up to but not including 6.7.2.0). The vulnerability carries a CVSS v3.1 base score of 8.1 (High) and a CVSS v4.0 base score of 6.0 (Medium) (Github Advisory, Shopware Issue).

The root cause is classified as CWE-362 (Concurrent Execution using Shared Resource with Improper Synchronization). Voucher code validation in Shopware's checkout process is not an atomic operation, meaning a timing window exists during which multiple concurrent checkout requests can each pass the voucher validity check before any single one marks the voucher as used. An attacker exploits this by applying a restricted (e.g., one-time-use) voucher across multiple simultaneous sessions and using a "single-packet attack" technique — sending all intercepted final checkout requests simultaneously — to ensure they arrive and are processed concurrently before the server can invalidate the voucher (Shopware Issue, Github Advisory). This technique is documented in PortSwigger research on single-packet attacks for exploiting remote race conditions.

Successful exploitation allows an attacker to redeem a limited-use voucher (e.g., a one-time-use discount code) multiple times across simultaneous checkout sessions, effectively bypassing the shop's promotional controls. This can result in unauthorized discounts, direct financial losses for the merchant, and undermining the integrity of the e-commerce platform's pricing and voucher management systems (Github Advisory, Shopware Issue). There is no direct confidentiality or availability impact; the primary risk is integrity-related financial fraud.

A proof-of-concept exploit is publicly referenced via the Shopware GitHub issue, and the attack can be performed using freely available tools such as the free version of Burp Suite (Shopware Issue). Exploitation requires the attacker to possess a valid restricted voucher code for the target shop, making it a low-privilege but preconditioned attack. There is no evidence of active in-the-wild exploitation at this time, and the vulnerability is not listed in the CISA KEV catalog. The EPSS score is approximately 0.038% (low probability of exploitation in the next 30 days) (Github Advisory).

1. Obtain a valid restricted voucher: Acquire a limited-use (e.g., one-time-use) voucher code for the target Shopware store, either through legitimate means (e.g., a promotional email) or by other methods.
2. Set up multiple sessions: Create multiple browser sessions or user accounts on the target Shopware store.
3. Add items to cart and apply voucher: In each session, add a product to the cart and apply the restricted voucher code to each cart.
4. Proceed to final checkout step: In each session, advance through the checkout process until reaching the final order submission step, but do not submit yet.
5. Intercept final checkout requests: Use a proxy tool such as Burp Suite (free version) to intercept the final checkout/order submission HTTP request from each session.
6. Execute single-packet attack: Send all intercepted checkout requests simultaneously to the server using the single-packet attack technique (e.g., via Burp Suite's parallel requests feature or HTTP/2 single-packet attack), ensuring all requests arrive and are processed concurrently before the server can mark the voucher as used.
7. Achieve voucher bypass: Due to the non-atomic validation, all concurrent requests pass the voucher validity check, and the restricted voucher is applied to multiple orders, exceeding its intended usage limit (Shopware Issue, Github Advisory).

• Logs: Multiple successful order completions within milliseconds of each other using the same voucher code; server access logs showing simultaneous POST requests to the checkout submission endpoint from the same or different IP addresses.
• Application Data: Voucher usage count in the database exceeding the configured maximum (e.g., a one-time voucher showing usage count > 1); multiple orders referencing the same restricted voucher code.
• Network: Burst of near-simultaneous HTTP requests to the Shopware checkout endpoint (e.g., /checkout/order) from one or more IP addresses, consistent with a single-packet or parallel request attack pattern.
• User Accounts: Multiple user accounts or guest sessions associated with the same voucher code completing orders in an unusually short time window (Shopware Issue).

Shopware has addressed this vulnerability in version 6.7.2.0 and above; affected organizations should upgrade immediately (Github Advisory). No specific configuration-based workaround has been published, but administrators are advised to implement additional monitoring of voucher usage patterns and review access controls for voucher management. After patching, thorough testing of voucher functionality is recommended to confirm the fix is effective (Shopware Issue).

The vulnerability was reported by Juri Himmelreich and disclosed via the Shopware public GitHub issue tracker on July 15, 2025, with the CVE published on August 6, 2025. A full disclosure post was published on the Seclists Full Disclosure mailing list (Seclists). No significant broader media coverage or notable researcher commentary beyond the initial disclosure has been identified.