There is a payment logic vulnerability in src/main/java/org/zdd/bookstore/web/controller/CartController.java and src/main/java/org/zdd/bookstore/web/controller/OrderController.java

[liyunqiangs]

The addToCart method in CartController.java does not perform a positive value check on the parameter buyNum.

The orderInfo method in OrderController.java only performed a non-negative check on the total amount of the shopping cart.

Therefore, it is possible to add items with negative prices to the shopping cart as long as the total amount is greater than 0.This has led to significant property losses.
The specific operation is as follows: