Session vulnerability Security

Hi

Text below is from hacker that Irecieved:

I found Security Vulnerability in your web application. For security purpose can we report vulnerability here,then will i get bounty reward in PayPal or Bitcoin for Security bug ?

I am in struggle with a hacker he inject some sort of data in session cart like:

rowId: 6d7b861f889ade22640579237d2e0846 product_id: 0001 name: Product 1

Ofcourse I am filtering data to NOT be inserted in the DB to prevent not having a product that is not in the products table but he/she is causing me trouble and has asked to receive bitcoin!! recently

The package is "mindscms/laravelshoppingcart": "^2.1",

I have SSL (https) on site and put .env file before public_thml folder and NOT placed in public access (a folder before) public_thm and config/session.php as below:

'driver' => env('SESSION_DRIVER', 'file'), // this set to file 'lifetime' => env('SESSION_LIFETIME', 120), // 120 'expire_on_close' => false, 'encrypt' => true, 'files' => storage_path('framework/sessions'), 'lottery' => [2, 100], 'cookie' => env( 'SESSION_COOKIE', Str::slug(env('APP_NAME', 'laravel'), '_').'_session' ),

'path' => '/',

'secure' => env('SESSION_SECURE_COOKIE'), // true 'http_only' => true, 'same_site' => 'lax',

finally set permission storage/framework/session to 755 and of course each session file 644

The method in class to add items to cart is attached.

If my language is not good, I apologize.

Any suggestions are welcome. Thank

The method to add in cart is

public function add(Request $request) {

$r = $request->validate([
	'id' => 'required|numeric|exists:products,id',
	'color' => 'sometimes|nullable|string',
]);

$p = Product::where('id', $r['id'])->first();

if (!$p) {
	return back()->with('warning', 'Access Denied !');
}

Cart::add([
	'id' => $p->id,
	'name' => $p->name,
	'qty' => 1,
	'price' => $p->price,
]);


// Here check if the data from csrt/session is in the products table in DB
$rows = '';
foreach (Cart::content() as $row) {
	$p = Product::where('id', $row->id)->where('name', $row->name)->first();

	if (!$p) {
		$rows .= 'rowId: ' . $row->rowId . ' product_id: ' . $row->id . ' name: ' . $row->name . "\r\n";

		Storage::append('file.log',  $rows);
		
		
	// remove the item
		Cart::remove($r['rowId']);
	}
}

return back()->with('success', 'Successfully added to cart.');

}