Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
MPOS/php-mpos
master @ 236cccd
43
Fixes
0
CVEs
HIGH
Peak severity
44.1%
Coverage
Highlights
Auth Bypass: 10 prior fixes. Scrutinize any change in this area.
public/include/classes/token.class.php: most-fixed (7 issues). Treat as high-risk during review.
22 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Auth Bypass: Token validation logic was repeatedly bypassed due to missing type checks, improper expiration handling, and weak token generation. Seven distinct fixes were needed to enforce type verification, DB-level expiration, and cryptographic randomness.
CSRF:
Race Condition: Manual payout processing had a double-spend race condition allowing concurrent withdrawals of the same balance. Fixed by offloading to a serialized cron job and setting a global active flag.