CVE-2025-30152: Sylius PayPal Plugin Order Manipulation Vulnerability

Background

The Sylius PayPal Plugin is an extension for the Sylius eCommerce platform that facilitates PayPal transactions. It allows merchants to integrate PayPal as a payment method, enabling customers to complete purchases seamlessly. However, a vulnerability has been identified that allows users to manipulate their shopping cart after completing the PayPal checkout process, potentially leading to financial losses for merchants.

Vulnerability Detail

The vulnerability arises from a flaw in the order completion process of the Sylius PayPal Plugin. After a user initiates a PayPal transaction and returns to the order summary page, they can alter the cart contents before finalizing the order. This manipulation can result in the order amount in Sylius being higher than the amount actually captured by PayPal, allowing users to receive products or services without paying the full amount. This compromises the integrity of the payment process and can lead to significant financial losses for merchants.

Workaround

If updating is not immediately possible, you can implement a workaround by overriding the 'PayPalOrderCompleteProcessor' with modified logic. Here is a sample code for the override:

<?php

declare(strict_types=1);

namespace App\Processor;

use Sylius\Bundle\PayumBundle\Model\GatewayConfigInterface;
use Sylius\Component\Core\Model\OrderInterface;
use Sylius\Component\Core\Model\PaymentInterface;
use Sylius\Component\Core\Model\PaymentMethodInterface;
use Sylius\PayPalPlugin\Manager\PaymentStateManagerInterface;

final class PayPalOrderCompleteProcessor
{
    public function __construct(private readonly PaymentStateManagerInterface $paymentStateManager) {
    }

    public function completePayPalOrder(OrderInterface $order): void
    {
        $payment = $order->getLastPayment(PaymentInterface::STATE_PROCESSING);
        if ($payment === null) {
            return;
        }

        /** @var PaymentMethodInterface $paymentMethod */
        $paymentMethod = $payment->getMethod();
        /** @var GatewayConfigInterface $gatewayConfig */
        $gatewayConfig = $paymentMethod->getGatewayConfig();

        if ($gatewayConfig->getFactoryName() !== 'sylius.pay_pal') {
            return;
        }

        try {
            $this->verify($payment);
        } catch (\Exception) {
            $this->paymentStateManager->cancel($payment);
            return;
        }

        $this->paymentStateManager->complete($payment);
    }

    private function verify(PaymentInterface $payment): void
    {
        $totalAmount = $this->getTotalPaymentAmountFromPaypal($payment);

        if ($payment->getOrder()->getTotal() !== $totalAmount) {
            throw new \Exception();
        }
    }

    private function getTotalPaymentAmountFromPaypal(PaymentInterface $payment): int
    {
        $details = $payment->getDetails();
        return $details['payment_amount'] ?? 0;
    }
}

Conclusion

The Sylius PayPal Plugin has a significant vulnerability that can lead to financial losses for merchants. It is crucial to update to the patched versions or implement the provided workaround to mitigate the risks associated with this issue.

See every vulnerability recorded for sylius/paypal-plugin →

FAQ