Youlai Mall CVE-2025-15084

No vendor-released patch identified at time of analysis. The vendor was contacted during responsible disclosure but provided no response. Organizations running Youlai Mall 1.0.0 or 2.0.0 should immediately review and audit the OrderController.orderService.payOrder method to implement explicit role-based access control (RBAC) checks before permitting access to payment data. Specifically, verify that users can only view payment information for orders they own or are explicitly authorized to manage, and that administrative payment operations require elevated privileges. If source code patches cannot be applied due to vendor non-response, implement compensating controls: configure network access controls to restrict the Order Payment API endpoint to trusted IP ranges or specific internal networks only; enforce mutual TLS (mTLS) authentication for payment operations; implement application-level audit logging to detect unauthorized access attempts to payment functions; and consider disabling or rate-limiting the affected payment endpoint until code-level fixes can be applied. Check the GitHub repository referenced in the POC (https://github.com/Hwwg/cve/issues/24) for community-contributed patches or workarounds. Evaluate upgrading to a newer version of Youlai Mall if available, though no specific patched version is confirmed in available data.